Load iframe on specific domains only

Question

I want to allow some websites to embed an iframe with a page from my domain. However, I don't want anybody to be able to use the iframe content without my permissions. How can I allow only domains of my choice to be able to embed the iframe with the page's content?

I know vimeo does this, and allows video owners to block the video on certain websites that they don't find appropriate.

I want server side ASP.NET solution, because Javascript code can be altered. However if it can be done using javascript code and its secure, It's ok.

From what I've seen, I need to pass the referrer in some way, but in a way that can be manually altered by other website owners to include the iframe themselves and it would work on their website too, without a permission.

Answer 1

Since it will be a standalone page as you mentioned in the comments, you can do this by inspecting the referer property.

Request.UrlReferrer

See that it contains the domain that you want to allow. This property is available when an embedder puts your page in the IFRAME's SRC attribute and the page loads for the first time.

If the user clicks on a link inside the IFRAME, it is not guaranteed to pass the containing page as a referrer.

If you want to allow multiple linked pages inside the IFRAME to allow a specific domain, then you will need to stick to a JavaScript based solution.

Note however that neither method is completely foolproof.