Contrib.social

X-Frame-Options is always SAMEORIGIN in response header

Open on Drupal.org →
Created on 5 October 2021, over 2 years ago
Updated 8 March 2023, over 1 year ago

Problem/Motivation

Wanted to embed some content from a D8 site in an iFrame in another site.

Steps to reproduce

Install X-Frame-Options Configuration , set it's config value to ALLOW ALL
(Image Allow-all.png)

Clear caches and reload the front page of the site and inspect the HTTP headers
It still says "X-Frame-Options: SAMEORIGIN"
(Image response-headers.png)

I put debugging points in this modules code, and see it hit
$response->headers->remove('X-Frame-Options');
But the X-Frame-Options headers are still there with a value of SAMEORIGIN
(Image code.png)

Am I missing something here/doing something wrong?

I also tried seckit https://www.drupal.org/project/seckit →
and http_response_headers https://www.drupal.org/project/http_response_headers →
Neither of those worked either, despite claiming they would be able to change X-Frame-Options.
Is Drupal core wielding it's big hammer, and insisting that X-Frame-Options SAMEORIGIN is always there?

I solved my "I need to put bits of my site into a iFrame on another site" problem by implementing an custom EventListener after reading this https://www.drupal.org/project/drupal/issues/2652616#comment-11433225 🐛 make x-frame-options configurable Postponed

This may not be a problem with x_frame_options at all, but I'm leaving this stream of consciousness, in case anyone else needs to spend a day going down this rabbit hole....

🐛 Bug report
Status

Fixed

Version

1.2

Component

Documentation

Created by

🇺🇸United States mr_scumbag Chattanooga TN USA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment over 1 year ago →
    🇧🇪Belgium matthieu_collet

    same problem here, this module doesn't work (Drupal 9.5.2)

  • Comment over 1 year ago →
    🇨🇦Canada efrainh

    Hey guys, thanks for reporting this issue, specially
    mr_scumbag.
    Sorry for the delay, I'm trying to fix it now.

  • Assigned to efrainh
  • Comment over 1 year ago →
    🇨🇦Canada efrainh
  • Status changed to Fixed over 1 year ago
  • Comment over 1 year ago →
    🇨🇦Canada efrainh

    I could not reproduce this issue on Drupal 9.5.3 with PHP 8.0, but when I upgraded PHP to version 8.1.14, I started seeing the header X-Frame-Options: SAMEORIGIN, using no matter what Directive in the configuration.
    I lowered the priority, so it runs after, and included it in a new release https://www.drupal.org/project/x_frame_options/releases/8.x-1.3 → .

  • Comment over 1 year ago →
    🇲🇽Mexico girphpdeveloper

    hello @efrainh I have installed the new version, but I am still not able to disable X-Frame-Options :(

    server: ESF
    set-cookie: __Secure-3PSIDCC=AFvIBn_KxB2n4ua0OVCGGYumhOg9MZphs0mYTWwtT2RJD8DZlvsrJVL17zgKAoEpKq01-N7YWu-T; expires=Tue, 27-Feb-2024 22:42:11 GMT; path=/; domain=.youtube.com; Secure; HttpOnly; priority=high; SameSite=none
    strict-transport-security: max-age=31536000
    vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-content-type-options: nosniff
    x-frame-options: SAMEORIGIN
    x-xss-protection:

  • Comment over 1 year ago →
    🇨🇦Canada efrainh

    Hi @ girdevmx, does that happen with any of the options in the configuration?
    Please provide your Drupal core and PHP version, so I can try to reproduce the issue.

  • Comment over 1 year ago →
    System Message

    Automatically closed - issue fixed for 2 weeks with no activity.

  • Comment about 1 year ago →
    🇧🇪Belgium kwinten-hardies Vlaams-Brabant

    I am using version 8.x-1.3 with php version 8.1.10 and Drupal core 9.5.8. The x-Frame-Options is always set as SAMEORIGIN. No matter what setting I use in the module.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024