1

Running EE 3.5.11

In the portfolio section of my website, I display websites that I have built using an iFrame. Most of them work and display properly, but there are a handful of ExpressionEngine sites that I built that do not show properly, but instead I get the following console error:

does not permit cross-origin framing

One that works correctly: http://rouviere.com/our-work/project/se-wind-supply-chain-map

One that does not work correctly: http://rouviere.com/our-work/project/cameron-clinic

They all use the same code for the iFrame:

<iframe id="webview"  src="{website_url}"></iframe>

I contacted the host for the sites that do not display in the iFrame and they said that they do not have any server settings that would be blocking cross-origin framing.

Any suggestions for solving this would be appreciated.

3

Le sigh... I always forget to RTFM.

https://docs.expressionengine.com/v3/general/system_configuration_overrides.html#x-frame-options

You can set it in your config.php to NONE.

Edit Just FFS, here's how I figured it out:

cd ~/ee3-path/
grep -nr X-Frame-Options

Results had this line:

ee()->output->set_header('X-Frame-Options: '.$frame_options);

Next up:

grep -nr \$frame_options

Results:

$frame_options = ee()->config->item('x_frame_options');

Hrmm config...damnit, config item.

| improve this answer | |
  • 1
    Problem solved. Well done sir! – forrest Dec 28 '17 at 4:23
0

They do. They are just not trying for you, or are not able to figure out where the header is being set. It is perhaps being set by a reverse-proxy like CloudFlare. Perhaps try adding the sandbox attribute to your iframe and see if setting allow-same-origin helps your issues.

Read up on the attribute here:

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe

Yes, to confirm, your iframe that isn't loading is at a url that is giving this response header:

X-Frame-Options:SAMEORIGIN

Outside of the frame. They are serving that X-Frame-Option some how. Having dealt with people like this...

One suggestions; learn to use curl to output response header. Then send the web host support your exact CLI curl command and output, so they can't say "Hurr durr it's not true". You often have to shove it in someones face to get them to understand and actually try for you.

Edit If you have access to these sites servers, look in the vhosts files, the htaccess files, and your index.php file. Header can be set in any of those files. Also looks like that site is fronted by nginx, so perhaps it is an nginx setting (don't know nginx well enough to direct you), or more commonly nginx is used as a reverse proxy (think CDN).

| improve this answer | |
  • Thank you for the response and assessment. I checked with the host and they ran a header test on the following URL, which is just a simple php file jlloydmorgan.com/headertest.php using webconfs.com/http-header-check.php and there is no reference to the X-Frame-Options => SAMEORIGIN, however if you run the same check on the root domain, it does show that. So there is something happening within ExpressionEngine to generate that. Any ideas what within EE could be doing that? – forrest Dec 27 '17 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.