python - How to remove the Xframe Options header in django? -
i have made page has iframe
. inside iframe
want show multiple different links article facebook, or news, or youtube video or other possible url. but, due xframe header, unable so. referred following link: https://docs.djangoproject.com/en/1.8/ref/clickjacking/ , django xframeoptionsmiddleware (x-frame-options) - allow iframe client ip
but didn't help.
my settings.py file's middleware_classes
is:
middleware_classes = ( 'django.contrib.sessions.middleware.sessionmiddleware', 'django.middleware.common.commonmiddleware', 'django.middleware.csrf.csrfviewmiddleware', 'django.contrib.auth.middleware.authenticationmiddleware', 'django.contrib.auth.middleware.sessionauthenticationmiddleware', 'django.contrib.messages.middleware.messagemiddleware', 'django.middleware.clickjacking.xframeoptionsmiddleware', )
from http://django-secure.readthedocs.org/en/latest/middleware.html , found using decorator @frame_deny_exempt
problem can solved. still, getting same error in chrome console i.e. refused display '<url>' in frame because set 'x-frame-options' 'sameorigin, sameorigin'.
any this??
you got wrong here if understand well. x-frame-options
browser honouring header on whether your site allowed within iframe rather allowing third site within iframe.
respectively, happens other site's headers. example facebook has set above header deny
, therefore browser honouring not allow site present no matter site's headers are.
Comments
Post a Comment