Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Refused to display site in an iframe, X-Frame-Options to 'SAMEORIGIN'

Getting an error when i try to inspect element in chrome:

Refused to display 'http://www.samplesite.com/' in a frame because it is set 'X-Frame-Options' to 'SAMEORIGIN'.

How to display a site inside an iframe in which the website has 'X-Frame-Options' to 'SAMEORIGIN'?

I tried searching on google but I could not find any proper solution, some are for asp.net only.

like image 322
zen Avatar asked Jun 26 '14 01:06

zen


People also ask

How do I fix refused connection in iframe?

How do I fix an iframe refused connection? Most probably web site that you try to embed as an iframe doesn't allow to be embedded. You need to update X-Frame-Options on the website that you are trying to embed to allow your Power Apps Portal (if you have control over that website).

How do I enable X frames in chrome?

To work with this addon, please open the toolbar popup and then click on the toggle button on the left side. Once the addon is turned ON, the browser ignores the x-frame-options for all iframes within websites. To whitelist a domain, please click on the - Add to whitelist - button on the toolbar popup.

What is the difference between setting X-Frame-options to deny vs SAMEORIGIN?

Mitigating clickjacking with X-Frame-Options response headerDENY – does not allow any domain to display this page within a frame. SAMEORIGIN – allows the current page to be displayed in a frame on another page, but only within the current domain.

How do I set X-Frame-options in HTML?

Double-click the HTTP Response Headers icon in the feature list in the middle. In the Actions pane on the right side, click Add. In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field. Click OK to save your changes.


1 Answers

Web server conf,

for me i use nginx.conf

find add_header X-Frame-Options SAMEORIGIN; and change it toadd_header X-Frame-Options "ALLOWALL";

Your web server sends the header and blocks the content. You should probably change this setting to Allow from same origin.

like image 127
Vaisakh VM Avatar answered Oct 11 '22 08:10

Vaisakh VM