CODEWITHSUNDEEP
javascriptjquerynode.jsiframe
Thamarai Kani
Thamarai Kani

Reputation: 11

'X-Frame-Options','SAMEORIGIN' Cross Domain Iframe issue

I have 2 projects in node JS. I have included the response to the header of my project is res. header('X-Frame-Options','SAMEORIGIN').

When I generate the source link and include it with the element , this link only working for my domain, I can't include the with other domains.

How can access the with a different domain

Thank you...!

Upvotes: 1

Views: 5206

Answers (2)

Udith Gunaratna
Udith Gunaratna

Reputation: 2111

The main purpose of adding the X-Frame-Options headers is to prevent your page from being rendered within an <iframe> (or within a <frame>, <embed>, <object>). Based on the value of the header, you can prevent it completely or just allow embedding within the same origin.

So if you need to allow rendering your page from any domain, you can just remove that header from the response.

Please refer this for more details https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Upvotes: 1

huesba
huesba

Reputation: 86

when it comes to security, I suggest using helmet.js. So better install helmet.js then use it as middleware for security issues. For example write code below:

const express = require("express");
const helmet = require("helmet");

app = express();
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      "frame-ancestors": ["'self'", "https://otherDomain.com", "https://www.oneMoreDomain.com"]
    }
  }
}));

ContentSecurityPolicy's frame-ancestors is doing the same thing as FRAME-OPTIONS, but you can add whitelist of domains which will have permission using frames.

Upvotes: 4

Related Questions