I am having an issue using X-Frame-Options
to embed one site as an iFrame into another (different domains) with IE 11 and Edge. My research and experience indicate that IE doesn't yet support CSP Level 2 frame-ancestors, so I must use X-Frame-Options
.
I have added the response header
X-Frame-Options: ALLOW-FROM https://<mysite>.com
to the site that needs to be embedded.
These are secured sites so I am unable to provide real URLs to this community.
When I launch the main site, which contains an iFrame with content from the second site, I am able to see the X-Frame-Options
header in the response for the iframe content and it looks to be applied correctly. However, IE indicates "...modified this page to help prevent cross-site scripting" and my frame contains only the #
symbol.
Due to timing and internal IT delays, I am unable to have both sites hosted in the same domain.
Can anyone help to explain what I did wrong in implementing X-Frame-Options
or if there is another option to achieve the desired effect?
ALLOW-FROM
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#Browser_Support