疑難雜症萬事通
在網路上遇到任何問題都可以在這邊找找看唷

Search

關於 x-frame-options: sameorigin ，我們在網路上蒐集到這些相關的討論、資訊與評價

相關標籤 相關照片 相關影片
在x-frame-options: sameorigin這個產品中，有1篇Facebook貼文，粉絲數超過2,018的網紅Kewang 的資訊進化論，也在其Facebook貼文中提到， Funliday-旅遊規劃 身處武漢肺炎疫情最慘重的觀光業中心，雖然大家都不出去旅遊，但我們也趁著這個時間增強自己的核心功能，小編今天來聊一下其中一個功能的技術議題。 Funliday 有個功能是把外部文章直接顯示在 Funliday 的 App 跟 Web 上，但遇到了一些技術性及著作權的問題，...

x-frame-options: sameorigin 在 Kewang 的資訊進化論 Facebook 的最佳解答

Kewang 的資訊進化論 By Kewang 的資訊進化論

2020-05-04 10:00:49 有 9 人按讚
  • Share this:

Funliday-旅遊規劃 身處武漢肺炎疫情最慘重的觀光業中心，雖然大家都不出去旅遊，但我們也趁著這個時間增強自己的核心功能，小編今天來聊一下其中一個功能的技術議題。

Funliday 有個功能是把外部文章直接顯示在 Funliday 的 App 跟 Web 上，但遇到了一些技術性及著作權的問題，相信應該也有朋友遇到過類似的狀況，今天就來分享一下吧。

在 Funliday App 上的顯示還算好處理，直接用 WebView 呈現就好，但在 Funliday Web 上就很難處理，這邊整理一下技術上可以實作的幾種方式。

1. iframe + original url：最暴力的方式，直接用 iframe 嵌入對方網址，但會有一些問題。像是無法讓 Google 大神爬內容、HTTP 網址無法嵌入、如果有設定 x-frame-options 為 SAMEORIGIN 的話就無法嵌入、CSP 的設定也有可能造成無法嵌入

2. iframe + proxy + funliday url：改善了第 1 種方式，直接在 Funliday server 這裡做 proxy，但還是會有無法讓 Google 大神爬內容以及內容網址如果是相對路徑時的導頁問題 (這應該好解決)

3. 寫爬蟲抓內容：比如 A 站就固定抓

，B 站就固定抓
的內容，然後直接顯示在 Funliday Web 上，但畫面可能會亂掉，所以要想辦法把 A 站跟 B 站的 CSS 也拿來用，在 CSS 前面也要想辦法加上 namespace 避免衝突

4. remote render：類似 2+3 的方式，就是把要顯示的網頁用 headless chrome render 完之後，再跟原本的內容一起顯示，但畫面應該是會亂掉。

技術面可以的解法都確認了之後，再來就是適法性的問題了，因為 234 會把對方的資料落地到 Funliday 上，所以可能會有著作權的問題。對科技及法律這塊當然要問有研究的 Ant Yi-Feng Tzeng 啦，請教了 ant 之後也得到了一些結論。

234 都會有著作權法的問題，所以基本上是不可行的，但只要著作權人有同意的話，則不在此限。

---

最後 Funliday Web 的實作方式跟 1234 都無關，而是改用類似預覽頁的方式在 Funliday Web 顯示原連結的 og:title 及 og:image，應該會再加上簡單如「以上內容未經重製與改作，來源均援引來源網頁內容」的聲明。

對於技術這部分也不複雜，在後台上稿時先取得原網頁的 og 資料，跟原本的 234 相比簡單太多了 XD

---

有經過 ant 同意，認為這個問題應該蠻多人都會遇到，所以分享給大家看看啦！

#著作權 #iframe #funliday

Tags:
Kewang 的資訊進化論

About author
這個粉絲頁會不定期分享小編從每日 RSS 清單所閱讀的心得或是自己的開發心得。
2018 followers 1844 likes "https://feedly.com/kewang"
View all posts
社群媒體上有些相關的討論：

x-frame-options: sameorigin 在 An option to disable `X-Frame-Options: SAMEORIGIN` for non ... 的推薦與評價

I would like to embed our private HackMD notes into an internal MediaWiki. But HackMD set X-Frame-Options which prevents us from doing so. ... <看更多>

x-frame-options: sameorigin 在 X-Frame-Options vs CSP Frame-Ancestors - YouTube 的推薦與評價

影片讀取中

security #CSP #clickjackingX- Frame - Options vs CSP Frame -AncestorsIn our earlier video, we have seen what is Content Security Policy and how ... ... <看更多>

你可能也想看看
x-frame-options設定
x-frame-options解決
x-frame-options iis
x-frame-options header
frame-ancestors
x-frame-options nginx
x-frame-options header not set
x-frame-options allow all
搜尋相關連結

#1. X-Frame-Options - HTTP - MDN Web Docs

The page can only be displayed if all ancestor frames are same origin to the page itself. ALLOW-FROM origin Deprecated. This is an obsolete ...

#2. X-Frame-Options · 系統與概念筆記

隨便調查一下，發現不只Google，像Facebook、Twitter、Yahoo這些大網站也紛紛在HTTP Header加入X-Frame-Options: DENY或SAMEORIGIN。

#3. X-Frame-Options、CSP frame-ancestors 網站內嵌限制實測

基於安全考量，現代網站通常會加上HTTP Header X-Frame-Options 或Content-Scurity-Policy(CSP) 防止Clickjacking (點擊劫持)。

#4. [資安]Clickjacking: X-Frame-Options header | Davidou的Blog

Header always append X-Frame-Options SAMEORIGIN. 裡面SAMEORIGIN你可以替換掉，不過基本上應該都是會想選這個. DENY表示文件無論如何都不能被嵌入 ...

#5. X-Frame-Options - How to Combat Clickjacking - KeyCDN

The sameorigin directive allows the page to be loaded in a frame on the same origin as the page itself. Below is what the header request will ...

#6. How to set 'X-Frame-Options' on iframe? - Stack Overflow

They have set the header to SAMEORIGIN in this case, which means that they have disallowed loading of the resource in an iframe outside of their ...

#7. X-Frame-Options (Headers) - HTTP 中文开发手册 - 腾讯云

另一方面，如果指定 SAMEORIGIN ，只要包含在框架中的站点与为页面提供服务的站点相同，仍然可以在框架中使用该页面。 DENY 无论站点尝试这样做 ...

#8. HTTP headers | X-Frame-Options - GeeksforGeeks

sameorigin : This directive allows the page to be rendered in the frame if the frame has the same origin as the page. allow-from uri: This ...

#9. X-Frame-Options: SAMEORIGIN (instance security hardening)

Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.

#10. Set X-FRAME-OPTIONS in ASP.NET Core

X -FRAME-OPTIONS is a web header that can be used to allow or deny a page to be iframed. This is very important when protecting against clickjacking attempts ...

#11. X-Frame-Options header | Adobe Commerce

SAMEORIGIN : (default) Page can be displayed only in a frame on the same origin as the page itself. WARNING. The ALLOW-FROM <uri> option has ...

#12. Clickjacking Defense - OWASP Cheat Sheet Series

X -Frame-Options Header Types¶ · DENY, which prevents any domain from framing the content. The "DENY" setting is recommended unless a specific need has been ...

#13. X-Frame-Options HTTP header | Can I use... Support tables for ...

Partial support refers to not supporting the ALLOW-FROM option. The X-Frame-Options header has been obsoleted by the frame-ancestors directive from Content ...

#14. How to configure frames with X-Frame-Options ... - A2 Hosting

sameorigin : When the X-Frame-Options header is set to sameorigin, content can only be loaded in a frame that has the same origin as the page itself. For example ...

#15. X-Frame-Options - TIBCO Product Documentation

X -Frame-Options · DENY: Prevents the rendering of the server web page within a frame. · SAMEORIGIN: Prevents the rendering of the server web page within a frame ...

#16. X-Frame-Options Header - Yellowfin Community

I've received a finding that Yellowfin isn't using X-Frame-Options: DENY in the HTTP Headers.

#17. Enabling the X-Frame-Options header

This option is optimal if you do not have valid users for an iFrame. SAMEORIGIN: If a parent page is from the same domain as your site page, the site page can ...

#18. X-Frame-Options HTTP Header | Web application developer

SAMEORIGIN indicates to the browser that the page can be framed within the same host origin. An example use-case for this directive is when using Yii 2's ...

#19. Missing X-Frame-Options Header - Invicti

Invicti detected a missing X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP header ...

#20. An option to disable `X-Frame-Options: SAMEORIGIN` for non ...

I would like to embed our private HackMD notes into an internal MediaWiki. But HackMD set X-Frame-Options which prevents us from doing so.

#21. Set x-frames-options header values depending on URI

Solved: Hello, I am trying to write an irule that sets the x-frame-options header value to SAMEORIGIN or a site, unless the URI contains a specific string.

#22. How X-Frame-Options prevents clickjacking - Educative.io

HTML has options to disable elements that are responsible for such attacks. This HTML response header, known as, X-Frame-Options either disallows the browser to ...

#23. X-Frame-Options header | Adobe Commerce Developer Guide

SAMEORIGIN : (The default Magento setting.) Page can be displayed only in a frame on the same origin as the page itself. The ALLOW-FROM <uri> ...

#24. Clickjacking Protection - Django documentation

This middleware is enabled in the settings file generated by startproject . By default, the middleware will set the X-Frame-Options header to DENY for every ...

#25. Unable to Override the HTTP Response Headers X-Frame ...

You are unable to update the values of HTTP Response header "X-Frame-Option". You are seeing it set as "SAMEORIGIN", but you want to change ...

#26. What is Clickjacking | Attack Example | X-Frame-Options Pros ...

The DENY option is the most secure, preventing any use of the current page in a frame. More commonly, SAMEORIGIN is used, as it does enable the use of frames, ...

#27. Enable X-FRAME-Options header to implement clickjacking ...

TLDR: Add X-FRAME-Options: SAMEORIGIN to all HTTP(S) pages (server config), and test that nothing breaks. — Description: HTTP headers on requests that start ...

#28. How to Disable the "X-Frame-Options=SAMEORIGIN" Header ...

Starting with PingFederate 7.3, by default PingFederate adds the "X-Frame-Options=SAMEORIGIN" Header in response to the incoming requests.

#29. Allow X-Frame-Options

This extension enables you to remove the x-frame-options from the HTTP response header. To work with this addon, please open the toolbar ...

#30. Refused to display 'http://localhost:12345/api/reports/clients ...

This means that the application has disallowed loading of the resource in an iframe outside of its domain. For more information see The X-Frame-Options response ...

#31. Configuring the X-Frame-Options HTTP response header - IBM

To prevent possible clickjacking attacks, in IBM Intelligent Operations Center the X-Frame-Options HTTP response header is set to SAMEORIGIN.

#32. Day 3 - CORS, Same-origin policy 和iFrame - iT 邦幫忙

Refused to display 'URL' in a frame because it set 'X-Frame-Options' to 'deny'. 接下來，我們將花額外1 ~ 2 個篇幅介紹一個常碰到的瀏覽器標準- Same-origin ...

#33. Refused to Display in a Frame Because It Set 'X-frame ...

The refused to display in a frame error happens because it set 'x-frame-options' to 'sameorigin'. Consequently, you cannot use the URL in any structures or ...

#34. Web Agent X-Frame-Options introduced and explanations

The following browsers support X-Frame-Options headers. | Browser | DENY/SAMEORIGIN Support Introduced | ALLOW-FROM Support Introduced |

#35. X-Frame-Options Header gegen Clickjacking

X -Frame-Options Header gegen Clickjacking ... Diese Einstellung erlaubt die Einbettung in einem Frame nur dann, wenn das Protokoll der Webseite (http:// oder ...

#36. Insecure or unset HTTP headers - X-Frame Options

Description​. The application uses the X-Frame Options header on the server responses as the only protection mechanism against clickjacking. This header is ...

#37. Bypassing x-frame-options - Medium

The X-Frame-Options HTTP response header can be used to indicate whether or ... DENY: block everything in a frame; SAMEORIGIN: block everything except if ...

#38. Mitigating framesniffing with the X-Frame-Options header

In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field. Click OK to save your changes. If you have other ...

#39. How to fix misconfigured X-Frame-Options - Astra Security

Below is what the header request will look like if this is enabled. x-frame-options: DENY This might be a great way to lock down your site, but ...

#40. X-Frame-Options - HTTP - W3cubDocs

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> , <iframe> ...

#41. Support of the X-Frame-Options Header ALLOW-FROM property

You have an application or resource which will set the X-Frame-Options header as recommended to prevent Clickjacking attacks You have configured the ...

#42. X-Frame-Options - Test » Server Validation - ValidBot

This test will look for the presence of the 'X-Frame-Options' header and make sure it has a value of either SAMEORIGIN or DENY . If the header is missing or ...

#43. Clickjacking: X-Frame-Options header - Vulnerabilities

The server did not return an X-Frame-Options header with the value DENY or SAMEORIGIN, which means that this website could be at risk of a clickjacking ...

#44. AWS::CloudFront::ResponseHeadersPolicy FrameOptions

Determines whether CloudFront includes the X-Frame-Options HTTP response header and the header's value. ... Valid values are DENY and SAMEORIGIN .

#45. X-Frame-Options vs CSP Frame-Ancestors - YouTube

security #CSP #clickjackingX- Frame - Options vs CSP Frame -AncestorsIn our earlier video, we have seen what is Content Security Policy and how ...

#46. Why can't I disable X-Frame-Options or use CSP instead?

Is X-frame-options set on FusionAuth's web server or is it set inside the app? When I request the root auth page, it shows the header set to deny. I've read the ...

#47. X-Frame-Options HTTP Header: Syntax, Directive, Examples

The values using the X-Frame-Options HTTP Header are the “deny” and “sameorigin”. An example of X-Frame-Options HTTP Header is written below.

#48. X-Frame-Options Tester | Site24x7 Tools

The X-Frame-Options HTTP response header is used to tell a browser if it should allow a web page to be displayed in a <frame>, <iframe>, or <object> HTML ...

#49. X-Frame-Options Configuration | Drupal.org

This might be useful when you want to include one of the pages of your site inside an iframe in another site. The directives must be: 1. DENY 2.

#50. How to embed iframes by bypassing X-Frame-Options and ...

There are two methods to bypass iframe blocking: By removing X-frame options and adding the frame-ancestor directive to the Content-security ...

#51. how to allow X-Frame-Options to sameorigin ? | OutSystems

... it's still have error X-Frame option same-origin, and i try with ... page that has the X-Frame-Options set to sameorigin than you can't.

#52. X-Frame-Options - HTTP header explained

The HTTP X-Frame-Options response header is used to place restrictions on how the client's browser can display the page ... deny; sameorigin; allow-from URI.

#53. 17. Security HTTP Response Headers

The X-Frame-Options response header instructs the browser to prevent any site with this header in the response from being rendered within a frame. By default, ...

#54. X-Frame-Options Setting Malformed - OWASP ZAP

... your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY.

#55. How to Configure the X-Frame-Options Header to Mitigate ...

Oracle HTTP Server - Version 11.1.1.2.0 and later: How to Configure the X-Frame-Options Header to Mitigate Clickjacking Attempts Using OHS ...

#56. 'X-Frame-Options' to 'sameorigin'. | Velo by Wix - Forums

'X-Frame-Options' to 'sameorigin'. Cannot embed iFrame into page using htmlcomponent and "posting" src to script tag. How do i go about resolving this error ...

#57. Configuring X-Frame-Options | Qlik NPrinting Help

The X-Frame-Options header is a security measure that prevents Qlik ... xfs.headers.option=SAMEORIGIN ... X-Frame-Options: ALLOW-FROM https://domain.com.

#58. Secure Nginx from Clickjacking with X-FRAME-OPTIONS

Secure Nginx from Clickjacking with X-FRAME-OPTIONS · SAMEORIGIN: This setting will allow the page to be displayed in a frame on the same origin as the page ...

#59. RFC 7034: HTTP Header Field X-Frame-Options

Examples of X-Frame-Options X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN X-Frame-Options: ALLOW-FROM https://example.com/ 2.3. Design Issues 2.3.1.

#60. RFC 7034 - HTTP Header Field X-Frame-Options

HTTP Header Field X-Frame-Options (RFC 7034, October 2013) ... SAMEORIGIN A browser receiving content with this header field MUST NOT display this content ...

#61. refused to display in a frame because it set 'x-frame-options' to ...

In the default HTTP security headers X-Frame-Options is set to DENY. Which means this application url can not be used in any frame/iframes. If we use url in any ...

#62. CORS, Blank Page - X-FRAME-OPTIONS Errors

header( 'X-Frame-Options: SAMEORIGIN' );. WordPress adds this to your header using a hook. If you are familiar with hooks, you'll know that ...

#63. How to Configure Frames With X-Frame-Options Header

The X-Frame-Options header is an HTTP response header indicating if a browser can use ... in a frame because it set 'X-Frame-Options' to 'sameorigin.' ...

#64. Webframe X-Frame-Options "SAMEORIGIN" Error

Reason being that they send an "X-Frame-Options: SAMEORIGIN" response header. This option prevents the browser from displaying iFrames that are not hosted on ...

#65. Refused to display 'https://somedomain.com' in a frame ...

Looker doesn't include the X-Frame-Options: sameorigin header in pages intended for embedding. This includes /dashboards, /looks, etc. This does ...

#66. Problem with "X-Frame-Options: SAMEORIGIN" and IFrame

Problem with "X-Frame-Options: SAMEORIGIN" and IFrame. We use YT 7.0. Problem: Started by Internet Explorer: If we start a Link (as IFrame) to a YT-Ticket ...

#67. Changing X-Frame Options - DNN Corp. Customer Support

#68. Okta inside iframe getting 'X-Frame-Options' to 'sameorigin ...

I am getting error 'X-Frame-Options' to 'sameorigin' as suggestions in support enabled Iframe embedded still getting same issue. please help ...

#69. Multiple X-Frame-Options Header Entries - iothreat

The header can have three values: DENY, SAMEORIGIN, and ALLOW-FROM. The 'Multiple X-Frame-Options Header Entries' vulnerability occurs when a web application ...

#70. URGENT: CC Card Fields not shown with X-Frame-Options to ...

A few times lately I get a X-Frame-Options error on ... in a frame because it set 'X-Frame-Options' to 'sameorigin'. Same origin errors are ...

#71. How to Remove X-Frame-Options SAMEORIGIN from ...

You can remove the HTTP header X-Frame-Options: SAMEORIGIN from WordPress by removing the send_frame_options_header function from the ...

#72. Disabling X-FRAME-OPTION: SAMEORIGIN HTTP Response ...

Got to your Sharepoint Admin -> Manager Service Applications - > Excel Service Application ->Global Settings-> Check Allow Cross Domain ...

#73. X-Frame-Options configured but flagged on scan

However, if the response contains "X-Frame-Options:SAMEORIGIN", then I agree that QID 150081 should not be reported on the URL. Since it is, I would check ...

#74. 解決tomcat上X-Frame-Option及X-XSS-Protection未設定的問題

才能將X-Frame-Options的值改成SAMEORIGIN，要注意哦！param-nmae是用antiClickJackingOption(注意大小寫)，不是X-Frame-Options。 不過 ...

#75. “X-Frame-Options“ directive set to “DENY - WordPress.org

“X-Frame-Options“ directive set to “DENY. Resolved Hanz17 ... But in the nginx configuration I have the value SAMEORIGIN set. Where could the problem be?

#76. Seven Important Security Headers for Your Website - htaccess

The X-Frame-Options (XFO) security header helps modern web browsers protect your ... Header set X-Frame-Options "SAMEORIGIN" </IfModule>.

#77. X-Frame-Options para mejorar la seguridad de tu web

Con la cabecera X-Frame-Options y el parámetro SAMEORIGIN bloquearemos para que nuestra web no pueda cargar en ningún iframe excepto desde ...

#78. X-Frame-Options: SAMEORIGIN matches all ancestors.

Feature: X-Frame-Options: SAMEORIGIN matches all ancestors. ... Currently, XFO performs a same origin check only against the top-level frame in a ...

#79. Getting around the 'X-Frame-Options' to 'SAMEORIGIN' issue

Try before you buy. It's a tried and tested method of getting new customers. Let the (potential) customer use your product with absolutely ...

#80. X-Frame-Options header | Magento 2 Developer Documentation

SAMEORIGIN : (The default Magento setting.) Page can be displayed only in a frame on the same origin as the page itself. ALLOW-FROM <uri> : Page ...

#81. 'X-Frame-Options' header confusion.. - Tableau Community

This means that Tableau Server adds the 'X-Frame-Options: SAMEORIGIN' header to certain responses from the server.

#82. X-FRAME-Options Reference Guide - Liferay Help Center

properties file) located inside the portal-impl.jar . # Set this to true for the portal to send the "X-Frame-Options: DENY" HTTP # header to ...

#83. 資安JAVA(九)：X-Frame-Option - Web Security Notes

addHeader("X-FRAME-OPTIONS", "SAMEORIGIN"); Option 3: Allow-From (allowed, but only the chosen orgin) 此選項允許該頁面被嵌入到框架，但只限於 ...

#84. Does setting "X-Frame-Options" to SAMEORIGIN on Spotfire ...

Keywords: Spotfire Server, X-Frame-Options, SAMEORIGIN, clickjacking Answer: With configuration properties...

#85. Is possible to load site with X-Frame-Options: SAMEORIGIN in ...

Does extensions v3 have any way to make sites that have installed X-Frame-Options: SAMEORIGIN load in iFrame? I'm actually wondering if it's possible to move an ...

#86. 'X-Frame-Options' to 'SAMEORIGIN'. 解决方法- 韩小禹- 简书

'X-Frame-Options' to 'SAMEORIGIN'. 解决方法. 韩小禹. 简书作者. 2020-03-28 10:31IP属地: 北京 打开App. 需求：网站A中需要通过iframe加载网站B的页面。

#87. Refused to display 'URL' in a frame because it set 'X-Frame ...

The issue is the originating server is sending a header ('X-Frame-Options' to 'sameorigin') which prevents you from embedding that page in ...

#88. Change the HEADER X-Frame-Options to one of my ...

You cannot display a lot of websites inside an iFrame. Reason being that they send an “X-Frame-Options: SAMEORIGIN” response header. This option ...

#89. X-Frame-Options set as “SAMEORIGIN” - Developers & API

When I was using asana to get the callback access path in our web application, I met the x-frame-options set as “SAMEORIGIN”.

#90. iFrames and x-frame-options - Salesforce Developer Community

Specifically, login.salesforce.com returns x-frame-options:deny on the final call to login.salesforce.com, if you're familiar with the ...

#91. Content in iFrame in Mendix blocked because of X-Frame ...

The reason seems to be the x-frame-option set to 'sameorigin'. How can I resolve this issue? asked 2021-10-18. Steven Samuels Brusse. 2 answers.

#92. Add X-Frame-Options Cpanel Ports

I just went through a PCI scan Feb 28, 2017. TrustWave was dinging ports 2082, 2083, 2087, 2096 for X-Frame-Options which I think should be a value of Deny.

#93. How to disable the X-FRAME-OPTIONS response header

The X-Frame-Options HTTP response header can be used to indicate whether a browser ... SAMEORIGIN (will prevent framing by external sites), ...

#94. X-Frame-Options简介_zzhongcy的博客

另一方面，如果设置为 SAMEORIGIN ，那么页面就可以在同域名页面的frame 中嵌套。 DENY. 表示该页面不允许在frame 中展示，即便是在相同域名的页面中嵌套 ...

#95. Protéger son site web avec l'en-tête X-Frame-Options

La directive X-FRAME-OPTIONS peut prendre 3 valeurs : Deny : interdit tout chargement de la page à l'intérieur d'un iframe. Sameorigin ...

#96. 使用X-Frame-Options避免蓋台與Clickjacking攻擊- 不及格研究室

而X-Frame-Options 就是其中的一種防治手段,. X-Frame-Options 限制了iframe與物件的載入,. 有三種設定. DENY. 無論是誰都無法使用. SAMEORIGIN.