4

I am having an issue using X-Frame-Options to embed one site as an iFrame into another (different domains) with IE 11 and Edge. My research and experience indicate that IE doesn't yet support CSP Level 2 frame-ancestors, so I must use X-Frame-Options.

I have added the response header X-Frame-Options: ALLOW-FROM https://<mysite>.com to the site that needs to be embedded.

These are secured sites so I am unable to provide real URLs to this community.

When I launch the main site, which contains an iFrame with content from the second site, I am able to see the X-Frame-Options header in the response for the iframe content and it looks to be applied correctly. However, IE indicates "...modified this page to help prevent cross-site scripting" and my frame contains only the # symbol.

Due to timing and internal IT delays, I am unable to have both sites hosted in the same domain.

Can anyone help to explain what I did wrong in implementing X-Frame-Options or if there is another option to achieve the desired effect?

2

2 Answers 2

1

IE 11 not following standard, which means can not use "*", so have to give domain name with http/https.

  def cors_set_access_control_headers
    headers["Access-Control-Allow-Origin"] = "*"
    headers["Access-Control-Allow-Methods"] = "GET"
    headers["Access-Control-Request-Method"] = "*"
    headers["Access-Control-Allow-Headers"] = "Origin, X-Requested-With, Content-Type, Accept, Authorization"
    headers["X-Frame-Options"] = "ALLOW-FROM http://172.16.1.159"
    headers["X-XSS-Protection"] = "0"
  end
0

It turns out that the issue wasn't related to frames. The framed content had the same XSS error/note when accessed directly vs through an embedded iframe. The timing of the error showing threw me off since it was coincidental to the implementation of CSP level 2 frame-ancestors.

I have opened a case with MS to determine what in the content the XSS engine doesn't like and have had to disable the XSS in IE browsers with the X-XSS-Protection:0 response header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.