15

I want to embed my sharepoint 2013 pages in another document, but the X-FRAME-OPTIONS are set to SAMEORIGIN by default.

Adding ALLOW-FROM url does not work when added to the web.config OR on specific pages as <meta http-equiv="X-Frame-Options" content="allow" /> or <meta http-equiv="X-Frame-Options" content="ALLOW-FROM http://voyager/voyager" /> or <WebPartPages:AllowFraming runat="server" />.

What are my options here? I would like to globally allow my sharepoint content to be used in an iframe.

Improve this question
1

5 Answers 5

Reset to default
11

You might try Permissive XFrame Header, which is basically an HttpModule that can be enabled per Web Application.

Improve this answer
4
  • This is the correct solution.
    – tbone
    Aug 8, 2014 at 21:32
  • Thanks. Yes, this article fails to address framing-in PDF's for-example (that don't use a Master page) and hence the need for this HTTP Module that strips-out the annoying meta tag. Maybe the fundamental question is what puts it there?
    – PeterX
    Aug 19, 2014 at 5:52
  • 2
    +1, This worked for me with SharePoint 2013. Note, after running the PowerShell commands to enable the solution, you have to enable it on the Web Application. It's an application-level, not a site-level solution. Go to Central Admin -> Manage web applications. Select the correct application and click the Manage Features button in the WEB APPLICATIONS ribbon. Activate Permissive X-FRAME-OPTIONS Header and the HTTP header will be changed throughout the web app.
    – Nathan
    Sep 4, 2014 at 0:59
  • Doesn't seem to work with HTTP Posts. Added the solution, the iframe does show up, but when I try to upload files from within the iframe, SharePoint rejects the request sharepoint.stackexchange.com/questions/185378/…
    – dynamicallyCRM
    Jun 30, 2016 at 15:49
6

You can try putting the meta-tag in master page. I had the same issue with SP2010 and it worked there.

Or else you can try changing the X-Frame options tag from IIS manager. Here are the steps tpo do so:

•Go to Inetmgr -> Select the Web application ->Select and double click the HttpResponseHeaders for the application

•Select Add at the right hand side and give the values accordingly, for your case

Name: X-Frame-Options

Value: ALLOW

Improve this answer
4
  • 1
    Thanks for your post i use sp2013, tried your solution but still did not work it seems that sharepoint still override it. looking at fiddler I get these headers X-Content-Type-Options: nosniff X-FRAME-OPTIONS: ALLOW X-FRAME-OPTIONS: ALLOW X-FRAME-OPTIONS: SAMEORIGIN in order it seems the last one alway wins any other solution can you suggest
    – Nerdroid
    Jul 19, 2013 at 2:35
  • 1
    As per my comment above, you can put this new control in the Master Page <WebPartPages:AllowFraming runat="server" /> but it won't work when you frame-in a PDF (for example) as it's not using a Master Page. So the solution above with a HTTP Module seems to be required.
    – PeterX
    Aug 19, 2014 at 5:53
  • This did not work for me
    – kneidels
    May 15, 2016 at 12:25
  • didn't work here either
    – Aaron
    Jun 6, 2016 at 19:12
4

I hope this helps somebody in the future bcos I spent a little while scratching my head on it...

If you have blobcache enabled you will not be able to remove the X-Frame-Options header for any file type that's being cached.

Improve this answer
2

The iframe options are setup in the IIS and its mainly done to avoid Frameable clicking jacking attacks.

2.Page Level : I recommend you goto the specific html page with iframe and add a meta tag eg meta name=”X-FRAME-OPTIONS” content=”ALLOW-FROM” />

If the value contains the token ALLOW-FROM origin, the browser will block rendering only if the origin of the top-level browsing context is different than the origin value supplied with the Allow-From directive. For instance, if http://shop.example.com/confirm.asp contains the X-FRAME-OPTIONS directive with the value Allow-From https://partner.affiliate.com, then the page may be framed only by pages from the https://partner.affiliate.com origin.

3.IIS setting : The below mentioned details will ensure your entire site is configured with the X-Frame-Options specified above and all the pages in your site would be affected.

To configure IIS to add an X-Frame-Options header to all responses for a given site, follow these steps: 1. Open Internet Information Services (IIS) Manager. 2. In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect. 3. Double-click the HTTP Response Headers icon in the feature list in the middle. 4. In the Actions pane on the right side, click Add. 5. In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field. 6. Click OK to save your changes.

The "ALLOW-FROM" is generally not supported by most of the broswers. Refer: http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

Improve this answer
0
2

You can remove X-Frame-Option on "Application_PreSendRequestHeaders" of Global.asax.cs

protected void Application_PreSendRequestHeaders()
{
    Response.Headers.Remove("X-Frame-Options");
}

Thanks

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.