How to set 'X-Frame-Options' on iframe?

javascript jquery x-frame-options
Darien Fawkes picture Darien Fawkes · Dec 8, 2014 · Viewed 685.9k times · Source

If I create an iframe like this: 

var dialog = $('<div id="' + dialogId + '" align="center"><iframe id="' + frameId + '" src="' + url + '" width="100%" frameborder="0" height="'+frameHeightForIe8+'" data-ssotoken="' + token + '"></iframe></div>').dialog({

How can I fix the error:

Refused to display 'https://www.google.com.ua/?gws_rd=ssl' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

with JavaScript?

Answer

Drew Gaynor picture Drew Gaynor · Dec 8, 2014

You can't set X-Frame-Options on the iframe. That is a response header set by the domain from which you are requesting the resource (google.com.ua in your example). They have set the header to SAMEORIGIN in this case, which means that they have disallowed loading of the resource in an iframe outside of their domain. For more information see The X-Frame-Options response header on MDN.

A quick inspection of the headers (shown here in Chrome developer tools) reveals the X-Frame-Options value returned from the host.

enter image description here

Related questions

X-Frame-Options SAMEORIGIN blocking iframe on my domain

i'm using http://www.jacklmoore.com/colorbox to display the content of an url in a lightbox. after implementation, the colorbox did'nt showed anything. Later, i noticed the following error in chrome logs: Refused to display document because display forbidden …

Read More
Error: Permission denied to access property 'document'

I am continuously getting the error "Error: Permission denied to access property 'document'" while i have already define in my X-FRAME options to allow the other domain, like this.. <?php header('X-Frame-Options: ALLOW-FROM http://mydomain.com'); ?> Below is …

Read More
How do I redirect to another webpage?

How can I redirect the user from one page to another using jQuery or pure JavaScript?

Read More