up vote 0 down vote favorite
share [g+] share [fb]

I want one external page to be used in HTML IFRAMEs that are embedded in pages served from other origins within my page.

Take an example:

My page contents:

 <html>
  <body>
  <iframe style="height: 593px; width: 100%;" src="http://xxx.com/test/"    name="urlPx2473258" id="urlPx_2473258"></iframe>
  </body>
 </html>

It's in the captured HTTP packets as follows:

   Request===>
     `GET http://xxx.com/ HTTP/1.1
      Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/xaml+xml,     application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, */*
     Referer: https://plmtest2.apple.com/Agile/PLMServlet?module=LoginHandler&opcode=forwardToMainMenu
     Accept-Language: en-us
     User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
     Accept-Encoding: gzip, deflate
     Host: wikiserver.apple.com
     Connection: Keep-Alive

Response===>
 HTTP/1.1 200 OK
 Date: Wed, 14 Sep 2011 22:14:30 GMT
 Server: Twisted/8.2.0 TwistedWeb/8.2.0
 Content-Length: 15626
 Accept-Ranges: bytes
 Cache-Control: no-cache, no-store, must-revalidate, max-age=0, max-age=60
 Content-Type: text/html;charset=utf-8
 Expires: Wed, 14 Sep 2011 22:15:28 GMT
 MS-Author-Via: DAV
 X-Frame-Options: SameOrigin
 X-UA-Compatible: IE=EmulateIE7
 Connection: close`

As can be seen, the value is set to "SameOrigin". However, the origin is app server and the frame content is from Wiki server. Therefore, the content cannot be displayed.

I can not make any changes for external page (out of my control). Is any idea I can archive this?

link|improve this question
54% accept rate
feedback

1 Answer

up vote 0 down vote accepted

The whole purpose of X-Frame-Options is to prevent other, potentially malicious web sites from doing exactly what you're trying to do. You'll need to find some way to turn it off at the source.

link|improve this answer
I cannot turn it off at the source as the app server is out of my control. But really I have get allowed to use their page within iframe. I advised them to remove X-Frame-Options but they said no because this is being used organization wide. – Jammy C.c Sep 21 '11 at 4:26
You're probably out of luck, then, unless you can figure out some way to make the page containing the frame run on the same domain as the target. Also, you may want to edit the hostnames out of your packet dumps. – duskwuff Sep 21 '11 at 5:10
thanks. Is any way I can use JS, redirect or directly read the page source to put a new page that to be rendered? – Jammy C.c Sep 21 '11 at 5:29
You can redirect the browser to a page on the target domain, but only at the top level (e.g, window.location = newloc). You can't read its content from another domain, nor can you point a frame of any variety to it. – duskwuff Sep 21 '11 at 5:37
Thanks so much, Is any another way to render the external page as a portal embedded my page? – Jammy C.c Sep 21 '11 at 5:44
show 3 more comments
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.