blocks|key|5311105|text|您可以将此选项添加到.htaccess、httpd.conf或VirtualHost+section|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5311106|Header+set+X-Frame-Options+SAMEORIGIN+this+is+|unordered-list-item|5311107|ordered-list-item|5311108|5311109|5311110|并非所有浏览器都支持Allow+from+URI。参考：X-Frame-Options+on+MDN|5311111|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options^0|A|9|K|A|V|B|0|0|11|0|0|0|0|A|E|S|M|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|13|8|@$9|14|A|15|B|C]]|D|@]|E|$]]|$1|I|3|-4|5|J|7|16|8|@]|D|@]|E|$]]|$1|K|3|-4|5|6|7|17|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|18|8|@]|D|@]|E|$]]|$1|M|3|N|5|6|7|19|8|@$9|1A|A|1B|B|C]]|D|@$9|1C|A|1D|1|1E]]|E|$]]|$1|O|3|-4|5|6|7|1F|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]]]

<ol>
<li>You can add to <code>.htaccess</code>, <code>httpd.conf</code> or <code>VirtualHost</code> section</li>
<li><code>Header set X-Frame-Options SAMEORIGIN</code> this is the best option</li>
</ol>

<code>Allow from URI</code> is not supported by all browsers. Reference: <a href="https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options" rel="noreferrer">X-Frame-Options on MDN</a>

blocks|key|1513966|text|请参阅X-Frame-Options+header+on+error+response|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1513967|您可以简单地将以下行添加到.htaccess|1513968|Header+always+unset+X-Frame-Options|code-block|syntax|javascript|1513969|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/28515795/x-frame-options-header-on-error-response/28643935#28643935^0|3|14|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|X|8|@]|9|@]|C|$I|J]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]]]

See <a href="https://stackoverflow.com/questions/28515795/x-frame-options-header-on-error-response/28643935#28643935">X-Frame-Options header on error response</a>

You can simply add following line to .htaccess

<pre><code>Header always unset X-Frame-Options
</code></pre>

blocks|key|1514029|text|我在http+<VirtualHost+*:80>和https+<VirtualHost+*:443>虚拟主机块中添加了以下指令：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1514030|ServerName+your-app.com
ServerAlias+www.your-app.com

Header+always+unset+X-Frame-Options
Header+set+X-Frame-Options+"SAMEORIGIN"|code-block|syntax|javascript|1514031|这背后的原因是什么？默认情况下，如果设置，服务器不会重置X-Frame-Options头，所以我们需要首先删除默认值，在我的例子中是DENY，然后在下一个规则中，我们将它设置为所需的值，在我的例子中是SAMEORIGIN。当然，您也可以使用Header+set+X-Frame-Options+ALLOW-FROM+...规则。|1514032|entityMap^0|7|I|W|J|0|0|S|F|1U|4|2S|A|3C|15|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|T|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|U|8|@$9|V|A|W|B|C]|$9|X|A|Y|B|C]|$9|Z|A|10|B|C]|$9|11|A|12|B|C]]|D|@]|E|$]]|$1|M|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|N|$]]

What did it for me was the following, I've added the following directive in both the http <code>&lt;VirtualHost *:80&gt;</code> and https <code>&lt;VirtualHost *:443&gt;</code> virtual host blocks:

<pre><code>ServerName your-app.com
ServerAlias www.your-app.com

Header always unset X-Frame-Options
Header set X-Frame-Options "SAMEORIGIN"
</code></pre>

The reasoning behind this? Well by default if set, the server does not reset the <code>X-Frame-Options</code> header so we need to first always remove the default value, in my case it was <code>DENY</code>, and then with the next rule we set it to the desired value, in my case <code>SAMEORIGIN</code>. Of course you can use the <code>Header set X-Frame-Options ALLOW-FROM ...</code> rule as well.

blocks|key|1783086|text|这对我来说在所有浏览器上都有效：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1783087|1783088|在同一台服务器上创建了一个包含所有javascript|ordered-list-item|1783089|Created的页面和第二个页面，并使用object标记嵌入了第一个页面。在我的第三方站点上，我使用Object标记嵌入了第二个页面。|1783090|在原始服务器的public_html文件夹中创建了一个.htaccess文件，并将未设置X-Frame选项的页眉放入其中。|1783091|1783092|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|N|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|O|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|P|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|Q|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|L|$]]

This worked for me on all browsers:

<ol>
<li>Created one page with all my javascript</li>
<li>Created a 2nd page on the same server and embedded the first page using the object tag.</li>
<li>On my third party site I used the Object tag to embed the 2nd page.</li>
<li>Created a .htaccess file on the original server in the public_html folder and put Header unset X-Frame-Options in it.</li>
</ol>

blocks|key|3893724|text|我发现，如果httpd服务器中的应用程序有这样的规则：“如果X-Frame-Options头存在并且有一个值，就不管它；否则添加头X-Frame-Options:+SAMEORIGIN”，那么像"Header+always+unset+X-Frame-Options“这样的httpd.conf+mod_headers规则是不够的。SAMEORIGIN值将始终到达客户端。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3893725|为了解决这个问题，我添加了两个而不是一个mod_headers规则(在最外层的httpd.conf文件中)：|3893726|Header+set+X-Frame-Options+ALLOW-FROM+http://to.be.deleted.com+early
Header+unset+X-Frame-Options|code-block|syntax|javascript|3893727|第一条规则告诉任何内部请求处理程序，其他代理已经承担了防止clickjack的责任，它可以跳过拯救世界的尝试。它与“早期”处理一起运行。第二条规则去掉了完全不需要的X-Frame-Options头文件。它与“延迟”处理一起运行。|3893728|我还添加了适当的Content-Security-Policy头，这样世界仍然受到保护，而来自可信站点的多源Javascript仍然可以运行。|3893729|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

I found that if the application within the httpd server has a rule like "if the X-Frame-Options header exists and has a value, leave it alone; otherwise add the header X-Frame-Options: SAMEORIGIN" then an httpd.conf mod_headers rule like "Header always unset X-Frame-Options" would not suffice. The SAMEORIGIN value would always reach the client.

To remedy this, I add two, not one, mod_headers rules (in the outermost httpd.conf file):

<pre><code>Header set X-Frame-Options ALLOW-FROM http://to.be.deleted.com early
Header unset X-Frame-Options
</code></pre>

The first rule tells any internal request handler that some other agent has taken responsibility for clickjack prevention and it can skip its attempt to save the world. It runs with "early" processing. The second rule strips off the entirely unwanted X-Frame-Options header. It runs with "late" processing.

I also add the appropriate Content-Security-Policy headers so that the world remains protected yet multi-sourced Javascript from trusted sites still gets to run.

I am trying to allow some particular domain to access my site via iframe 

<pre><code>Header set X-Frame-Options ALLOW-FROM https://www.that-site.com
</code></pre>

I know this could be done by add the line above to the config of Apache server.

Two questions here.

1) which config file should be added to? The apache running on both Unix and windows, if not the same file

2) while enable the all-from, I still want to be able to run some iframe from my own domain. Can I just add the following line after the allow-from? 

<pre><code> Header set X-Frame-Options SAMEORIGIN
</code></pre>

Or I should just add my own domain in the all-from, ie 

<pre><code> Header set X-Frame-Options ALLOW-FROM https://www.that-site.com, http://www.my-own-domain.com
</code></pre>

Really need to get this solved out. Thanks in advance

X-Frame-Options on apache

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我正在尝试允许一些特定的域名通过iframe访问我的网站Header set X-Frame-Options ALLOW-FROM https://www.that-site.com我知道这可以通过将上面的行添加到Apache服务器的配置中来完成。这里有两个问题。1)应该添加哪个配置文件？同时在Unix和windows上运行的apache，如果不是同一个文件。2)在启用all-from的同时，我仍

问apache上的X-Frame-选项
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问apache上的X-Frame-选项EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问apache上的X-Frame-选项
EN