Embedding youtube video "Refused to display document because display forbidden by X-Frame-Options"

javascript php html security embed
Srikan picture Srikan · Mar 30, 2012 · Viewed 52.3k times · Source

I'm trying to embed a youtube video on to my page once the user gives the link to the video.

<iframe width=\'560\' height=\'315\' src='http://www.youtube.com/watch?v=<video id>&amp;output=embed' frameborder=\'0\' allowfullscreen></iframe>

But when I try to add this I get this error. After inspecting the page in chrome, I see this error in the console tab

"Refused to display document because of the display is forbidden by X-Frame-Options"

I'm not able to see the video even in IE and Firefox also

I even tried adding the 

 header('X-Frame-Options:Allow-From http://www.youtube.com'); 
 header('X-Frame-Options:GOFORIT);
 &amp;output=embed to the url

After reading certain solutions in other posts.

But I still get the same error.

I also see that the youtube has the method of object embedding to show the video, but already youtube has made that as old method of embedding the video. So I want to use the new iframe method of embedding the video on to my page.

Problem is seen in

  • Firefox 11
  • Chrome 18.0
  • IE 8

Anybody faced this problem?

Answer

duskwuff -inactive- picture duskwuff -inactive- · Mar 30, 2012

The page you're setting as the source of the iframe (the Youtube /watch page) doesn't want to be embedded in your page. You cannot force it to let you do that.

The correct URL to embed is of the form:

http://www.youtube.com/embed/oHg5SJYRHA0

Related questions

XSS - Which HTML Tags and Attributes can trigger Javascript Events?

I'm trying to code a secure and lightweight white-list based HTML purifier which will use DOMDocument. In order to avoid unnecessary complexity I am willing to make the following compromises: HTML comments are removed script and style tags are stripped …

Read More
How to show an alert box in PHP?

I want to display an alert box showing a message with PHP. Here is my PHP code: <?php header("Location:form.php"); echo '<script language="javascript">'; echo 'alert(message successfully sent)'; //not showing an …

Read More
"Mixed content blocked" when running an HTTP AJAX operation in an HTTPS page

I've a form which I'm submitting (through GET as it is required this way) to a crm (ViciDial). I can successfully submit the form however if I do that the processing file at crm will just echo a success text …

Read More