Getting the error Refused to display 'http://www.asp.net/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN' with iframe-resizer

Question

I am using the iframe-resizer to do some URL masking. I created a web application using the Visual Studio Template for ASP.NET MVC5 to act as a source of the iframe and a website with just one HTML page to host my iframe. The masked domain is hosted at http://bitmake.azurewebsites.net/ and it needs to be an ASP.NET site. The site that have the iframe is hosted at http://desenv.bitmake.tecnologia.ws/ and can be windows or linux. I own these two domains and can manage both. Everything is fine, all link i click works fine, except when i click on a link that redirects to another domain (http://www.anotherwebpage.com). Reading the documentation i see that is an option to solve this, the checkOrigin initialization option, so i initializing the resizer like this

 iFrameResize({
        log: true,
        checkOrigin: false,
        inPageLinks: true
    });

But i still receiving the error. You can check it at F12

Reading this SO question i see that it can be "workarounded" in the source site (bitmake.azurewebsites.net) from the file Global.asax. I changed my Global.asax to the "AllowAll" option but it still not working

score 2 · Accepted Answer · answered Nov 09 '15 at 08:23

The asp.net server is configured to not allow iframimg.

https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

Given that you don't control the remote domain, you only option is to proxy it and remove the header. However, given that the server owner doesn't want to be in your iFrame, this will likely breach copyright law.

Getting the error Refused to display 'http://www.asp.net/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN' with iframe-resizer

1 Answers1