Is it possible to combine SAMEORIGIN and other URL?

  • Resolved digbymaass

    (@digbymaass)


    8 years, 10 months ago

    # Recommended: SAMEORIGIN – iFrames from the same site are allowed – other sites are blocked
    # Block other sites from displaying your website in iFrames
    Header always append X-Frame-Options SAMEORIGIN

    Sometimes though I need to display from another URL that I control. Is it possible to add an Allow From https://some-url.com?

    And given that https://some-url.com is also protected by BPS how can I set it to allow this-url.com to show the content (eg when testing on a localhost installation)?

    https://www.ads-software.com/plugins/bulletproof-security/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author AITpro

    (@aitpro)

    https://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options

    X-Frame-Options
    Introduced in 2009 in Internet Explorer 8 was a new HTTP header X-Frame-Options which offered a partial protection against clickjacking[29][30] and was shortly after adopted by other browsers (Safari,[31] Firefox,[32] Chrome,[33] and Opera[34]). The header, when set by website owner, declares its preferred framing policy: values of DENY, SAMEORIGIN, or ALLOW-FROM origin will prevent any framing, framing by external sites, or allow framing only by the specified site, respectively. In addition to that, some advertising sites return a non-standard ALLOWALL value with the intention to allow framing their content on any page (equivalent of not setting X-Frame-Options at all).

    X-Frame-Options is very restrictive/limited in what you can do with the option settings and ALLOW FROM uri is not supported in Chrome, Opera and Safari. So basically it sounds like you cannot use X-Frame-Options code if you need to be able to display iFrames on different websites or you would have to duplicate things on each site instead of trying to display an iFrame from another site or use a different method besides an iFrame to access/retrieve/display data from different sites. Something like a JSON API or similar method.

    Thread Starter digbymaass

    (@digbymaass)

    Thanks for a very clear explanation!

    Plugin Author AITpro

    (@aitpro)

    Very Welcome.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Is it possible to combine SAMEORIGIN and other URL?’ is closed to new replies.

Tags