Menu
I'm going to create a website which — in addition to its own content — would have links (in iframes) to the world biggest newspaper websites like New York Times, Financial Times and some other.
But I've faced with a problem of framing permission. For example, NY Times shows me an error Load denied by X-Frame-Options: http://www.nytimes.com/ does not permit framing. I have read many forums and didn't found a workable solution. Tried to add Header always append X-Frame-Options SAMEORIGIN into .haccess file but it didn't help. Is there any way to solve this problem?
417
Alternate Solution: Install “Ignore X-Frame-Options Header” Firefox Add-on. This is a Firefox add-on that can be used to achieve the same results if you do not have access to the web server. Installing this Add-on will let you bypass the x-frame-options policy and allow the website to be loaded in the iframe.
X-Frame-Options allows content publishers to prevent their own content from being used in an invisible frame by attackers. The DENY option is the most secure, preventing any use of the current page in a frame. More commonly, SAMEORIGIN is used, as it does enable the use of frames, but limits them to the current domain.
Chrome does not support the ALLOW-FROM directive in X-Frame-Options. So if we are going to do anything involving other domains, we need something similar. We can stitch together a patchwork configuration involving both headers, which does something more than just allow same-origin framing.
Some websites have a server setting that will not allow other websites to "frame" their content. This is mainly to protect their copyrights and direct traffic to their websites only.
This is typically done by adding the following to Apache's configuration ( httpd.conf file):
Header always append X-Frame-Options SAMEORIGIN Unfortunately, there is really nothing you can do about it if you want to frame the website.
69
If your goal isn't to build a website (intended for others to visit) which embeds other websites inside your own, and this is truly for personal use, then a solution is to search for and install any add-on that lets you modify response headers, or even more poignant - get the "Ignore X-Frame-Options" add-on.
These add-ons will intercept the response from the remote server and allow you to replace the X-Frame-Options header value with ALLOWALL - which in turn will cause your browser to allow the response to be embedded in a frame.
As it turns out, another SO question even discusses the code required to write your own add-on that does this: Disable X-Frame-Option on client side
27
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
