CODEWITHSUNDEEP
javascripthtmliframe
user471317
user471317

Reputation: 1231

How to iframe a page from same domain with X-Frame-Options SAMEORIGIN?

We have this page, www.ourdomain.com/home.html

Inside home.html, there is an iframe with src set to yyy.ourdomain.com/index.html. All pages on yyy.ourdomain.com have X-Frame-Options set to SAMEORIGIN. And because of this header, the iframe content doesn't load. I get this error.

Firefox - Load denied by X-Frame-Options: http://yyy.ourdomain.com/index.html does not permit cross-origin framing.

Chrome - Refused to display 'http://yyy.ourdomain.com/index.html' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Both home.html and index.html have this line of javascript code -

document.domain = 'ourdomain.com';

How can I make this work?

PS - I don't have the option of removing the X-Frame-Options header.

Thanks.

Upvotes: 1

Views: 5973

Answers (1)

Yusef Maali
Yusef Maali

Reputation: 2431

The headers X-Frame-Options: DENY or X-Frame-Options: SAMEORIGIN won't allow you in any way to render a page in a <frame>, <iframe> or <object>.

The only working way I found, is to create a proxy page in the main domain that load the html content of the requested subdomain page.

See

for more information

Upvotes: 2

Related Questions