Site page is not shown in IFRAME issue

Hi, everybody!

Today’s post is not about SharePoint, but rather about regular Web development.

Recently writing a website showing content of the other site in IFRAMEs, I met a problem. The page of some sites were normally shown inside IFRAMEs, while the pages of some other sites weren’t – IFRAME was just empty.

But the same pages (which was not visible inside IFRAME) were absolutely normally visible if I navigated to that pages in standard way typing the URL in browser address text box. Mystery!

The first example where I observed such strange behavior was Tech Net’s Blogs.

If you don’t believe me, please create simple HTML file with the only content:

<iframe src=”http://blogs.technet.com/”     style=”width:1000px;height:700px;”>

Now try to open the file in any modern browser. The content is either empty (Firefox’s behavior) or has some warning like “To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame” (Internet Explorer and similar text with Opera).

It turned out that few years ago (if not months ago!), the browser producers added support for so-called “clickjacking protection” (see more details about it in the article “How To Fight Clickjacking (Using The Recent Twitter Hijacking As An Example)“). In few words – now browsers recognize “X-FRAME-OPTIONS” response header (with two possible values), and presence of this header in the response means that the page SHOULD NOT be shown in IFRAME.

So I needed somehow to ask the browser to ignore this response header. Unfortunately Firefox doesn’t have any option for it. So I had either to use some intermediary proxy like WebScarab, or to use Fiddler 2 asking it to remove undesired header.

I used the last one. There is documentation how to remove header from response stream in Fiddler 2. It worked like a charm.

UPDATE: Please notice, this approach works only on client side – so it is not possible to make a widely accessible site showing an arbitrary site in IFRAME if the latest site forbids showing itself in IFRAME using X-FRAME-OPTIONS.

In my case it worked, because I was the only user of my site.

Hope it helps!

Advertisement