Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I want to embed my sharepoint 2013 pages in another document, but the X-FRAME-OPTIONS are set to SAMEORIGIN by default.

Adding ALLOW-FROM url does not work when added to the web.config OR on specific pages as <meta http-equiv="X-Frame-Options" content="allow" /> or <meta http-equiv="X-Frame-Options" content="ALLOW-FROM http://voyager/voyager" /> or <WebPartPages:AllowFraming runat="server" />.

What are my options here? I would like to globally allow my sharepoint content to be used in an iframe.

share|improve this question

4 Answers 4

You might try Permissive XFrame Header, which is basically an HttpModule that can be enabled per Web Application.

share|improve this answer
    
This is the correct solution. –  tbone Aug 8 at 21:32
    
Thanks. Yes, this article fails to address framing-in PDF's for-example (that don't use a Master page) and hence the need for this HTTP Module that strips-out the annoying meta tag. Maybe the fundamental question is what puts it there? –  PeterX Aug 19 at 5:52
    
+1, This worked for me with SharePoint 2013. Note, after running the PowerShell commands to enable the solution, you have to enable it on the Web Application. It's an application-level, not a site-level solution. Go to Central Admin -> Manage web applications. Select the correct application and click the Manage Features button in the WEB APPLICATIONS ribbon. Activate Permissive X-FRAME-OPTIONS Header and the HTTP header will be changed throughout the web app. –  Nathan Sep 4 at 0:59

You can try putting the meta-tag in master page. I had the same issue with SP2010 and it worked there.

Or else you can try changing the X-Frame options tag from IIS manager. Here are the steps tpo do so:

•Go to Inetmgr -> Select the Web application ->Select and double click the HttpResponseHeaders for the application

•Select Add at the right hand side and give the values accordingly, for your case

Name: X-Frame-Options

Value: ALLOW

share|improve this answer
1  
Thanks for your post i use sp2013, tried your solution but still did not work it seems that sharepoint still override it. looking at fiddler I get these headers X-Content-Type-Options: nosniff X-FRAME-OPTIONS: ALLOW X-FRAME-OPTIONS: ALLOW X-FRAME-OPTIONS: SAMEORIGIN in order it seems the last one alway wins any other solution can you suggest –  Moes Jul 19 '13 at 2:35
    
As per my comment above, you can put this new control in the Master Page <WebPartPages:AllowFraming runat="server" /> but it won't work when you frame-in a PDF (for example) as it's not using a Master Page. So the solution above with a HTTP Module seems to be required. –  PeterX Aug 19 at 5:53

I hope this helps somebody in the future bcos I spent a little while scratching my head on it...

If you have blobcache enabled you will not be able to remove the X-Frame-Options header for any file type that's being cached.

share|improve this answer

The iframe options are setup in the IIS and its mainly done to avoid Frameable clicking jacking attacks.

2.Page Level : I recommend you goto the specific html page with iframe and add a meta tag eg meta name=”X-FRAME-OPTIONS” content=”ALLOW-FROM” />

If the value contains the token ALLOW-FROM origin, the browser will block rendering only if the origin of the top-level browsing context is different than the origin value supplied with the Allow-From directive. For instance, if http://shop.example.com/confirm.asp contains the X-FRAME-OPTIONS directive with the value Allow-From https://partner.affiliate.com, then the page may be framed only by pages from the https://partner.affiliate.com origin.

3.IIS setting : The below mentioned details will ensure your entire site is configured with the X-Frame-Options specified above and all the pages in your site would be affected.

To configure IIS to add an X-Frame-Options header to all responses for a given site, follow these steps: 1. Open Internet Information Services (IIS) Manager. 2. In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect. 3. Double-click the HTTP Response Headers icon in the feature list in the middle. 4. In the Actions pane on the right side, click Add. 5. In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field. 6. Click OK to save your changes.

The "ALLOW-FROM" is generally not supported by most of the broswers. Refer: http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.