If the 2nd company is happy for you to access their content in an IFrame then they need to take the restriction off – they can do this fairly easily in the IIS config. There’s nothing you can do to circumvent it and anything that does work should get patched quickly in a security hotfix. … Read more
Chrome offers the webRequest API to intercept and modify HTTP requests. You can remove the X-Frame-Options header to allow inlining pages within an iframe. chrome.webRequest.onHeadersReceived.addListener( function(info) { var headers = info.responseHeaders; for (var i=headers.length-1; i>=0; –i) { var header = headers[i].name.toLowerCase(); if (header == ‘x-frame-options’ || header == ‘frame-options’) { headers.splice(i, 1); // Remove header … Read more
The frame-src CSP directive (which is deprecated and replaced by child-src) determines what sources can be used in a frame on a page. The X-Frame-Options response header, on the other hand, determines what other pages can use that page in an iframe. In your case, http://a.com with X-Frame-Options: DENY indicates that no other page can … Read more
ALLOW-FROM is not supported in Chrome or Safari. See MDN article: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options You are already doing the work to make a custom header and send it with the correct data, can you not just exclude the header when you detect it is from a valid partner and add DENY to every other request? I don’t … Read more
If you want to remove the header completely, you can create an after_action filter: class FilesController < ApplicationController after_action :allow_iframe, only: :embed def embed end private def allow_iframe response.headers.except! ‘X-Frame-Options’ end end Or, of course, you can code the after_action to set the value to something different: class FacebookController < ApplicationController after_action :allow_facebook_iframe private def … Read more
If you’re using Java configs instead of XML configs, put this in your WebSecurityConfigurerAdapter.configure(HttpSecurity http) method: http.headers().frameOptions().disable();
You can’t set X-Frame-Options on the iframe. That is a response header set by the domain from which you are requesting the resource (google.com.ua in your example). They have set the header to SAMEORIGIN in this case, which means that they have disallowed loading of the resource in an iframe outside of their domain. For … Read more
I had a similar issue, where I was trying to display content from our own site in an iframe (as a lightbox-style dialog with Colorbox), and where we had an server-wide “X-Frame-Options SAMEORIGIN” header on the source server preventing it from loading on our test server. This doesn’t seem to be documented anywhere, but if … Read more