Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I want to show some content from Sharepoint in IFRAME. From some research, I come to know that specific setting for X-FRAME-OPTIONS in HTTP Header prevents rendering in iframes. How can I use ALLOW-FROM option of X-FRAME-OPTIONS to allow this? Given, I am admin for the Sharepoint Server 2013.

share|improve this question

4 Answers 4

1.Since you are admin , the iframe options are setup in the IIS and its mainly done to avoid Frameable clicking jacking attacks.

2.Page Level : I recommend you goto the specific html page with iframe and add a meta tag eg meta name=”X-FRAME-OPTIONS” content=”ALLOW-FROM” />

If the value contains the token ALLOW-FROM origin, the browser will block rendering only if the origin of the top-level browsing context is different than the origin value supplied with the Allow-From directive. For instance, if http://shop.example.com/confirm.asp contains the X-FRAME-OPTIONS directive with the value Allow-From https://partner.affiliate.com, then the page may be framed only by pages from the https://partner.affiliate.com origin.

3.IIS setting : The below mentioned details will ensure your entire site is configured with the X-Frame-Options specified above and all the pages in your site would be affected.

To configure IIS to add an X-Frame-Options header to all responses for a given site, follow these steps: 1. Open Internet Information Services (IIS) Manager. 2. In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect. 3. Double-click the HTTP Response Headers icon in the feature list in the middle. 4. In the Actions pane on the right side, click Add. 5. In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field. 6. Click OK to save your changes.

The "ALLOW-FROM" is generally not supported by most of the broswers. Refer: http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

share|improve this answer
    
iframe options aren't set in IIS, they're set in the SharePoint HttpModule, you can't do anything specifically in IIS to switch it off. –  James Love Sep 8 at 8:55

You can add the tag in your master page so it becomes global for all pages

share|improve this answer
1  
Can you please add more information regarding how to do that. It will help to make your answer more helpful :) –  Robert Lindgren Oct 2 '13 at 7:02
  1. You can use option ALLOW-FROM of X-FRAME-OPTIONS (I have not tested this). Beware that this is not supported by all the browsers.
  2. Add to your master page the following code

    <%@ Register Tagprefix="WebPartPages" Namespace="Microsoft.SharePoint.WebPartPages" Assembly="Microsoft.SharePoint, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %>
    <WebPartPages:AllowFraming runat="server"/>
    

    Pay attention because it only works with ASPX pages.

  3. Use the URL Rewrite IIS extension to remove the X-Frame-Options. You should check the origin of the request and remove the X-Frame-Options from the response. To do this, install the extension, go to the URL Rewrite config, add a new variable called RESPONSE_X-FRAME-OPTIONS and then you should define a new blank rule rewriting the value of X-FRAME-OPTIONS with an empty string.

share|improve this answer

According to this post you need to add a SharePoint 2013 specific tag to your ASPX page to disable the SharePoint 2013 default behavior of X-FRAME-OPTIONS.

The particular tag is:

<WebPartPages:AllowFraming runat="server" />

and as far as I can see it is required on each and every ASPX page you want to allow. I personally haven't figured out yet how to disable it globally (sigh).

share|improve this answer
    
I think you should write an handler to disable it globally –  Salvatore Di Fazio Feb 13 '13 at 10:44
    
BTW I have wrote the AllowFraming control in both the pages but I still have the x-frame-options error –  Salvatore Di Fazio Feb 13 '13 at 10:49
    
sorry I mean a IHttpModule not handler –  Salvatore Di Fazio Feb 13 '13 at 11:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.