是否可以阻止我们的网站在另一个域的框架集或 IFrame 内运行？
最近我们遇到了一个问题，其他网站在一个框架集中运行我们的电子商务网站，而我们的网站（附加了违规者附属 ID）是单个全宽框架中的唯一内容。 所以本质上它看起来和感觉就像我们的网站，其 URL 位于顶部。 我们可以切断他们的会员 ID，这会让他们这样做毫无意义，但这并不能阻止未来的罪犯做同样的事情，直到我们发现为止。
是否有一种通用方法（通过可能出现在每个页面上的 JavaScript？）来防止这种情况发生？ 请注意，向所有链接添加目标是不可行的，但向所有页面添加一段 JS 是可行的，因为页眉和页脚部分是从单个源在整个站点范围内共享的。
另一种可能性是在 Apache 级别（如果我们可以在服务器端做任何事情），因为我们确实通过 mod-rewrite 传递所有请求。
请注意，如果父页面源自我们的域，则仍然必须允许页面在 IFrame 内加载，因为我们有效地使用了 IFrame
We've been having an problem recently where other sites are running our e-commerce site inside a frameset where our site (with the offenders affiliate id tacked on) is the only content in a single full width frame. So essentially it looks and feels like our site with their URL at the top. We can cut off their affiliate id, which would make it pointless for them to do, but this doesn't prevent future offenders from doing the same thing until we find out about it.
Is there a generic way (through JavaScript that appears on every page perhaps?) to prevent this from happening? Note that adding targets to to all links is not feasible, but adding a snippet of JS to all pages is, since the header and footer portions are shared sitewide from a single source.
Another possibility would be at the Apache level (if there is anything we could do server side) as we do pass all requests through mod-rewrite.
Note that it would be essential to sill allow pages to load inside an IFrame if the parent page originates from our domain, as we make valid use of IFrames
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我听说这个问题的解决方案被称为“frame popper 脚本”。 谷歌很快就找到了此帖子。 看起来这是最简单的之一：
I've heard of solutions to this problem being referred to as a "frame popper script". A quick google comes up with this thread. Looks like this is one of the simplest:
我相信实现这一点的正确现代方法是使用 X-框架选项响应标头。
来自 MDN：
看一下：如何防止 IFRAME重定向顶级窗口
I believe the proper modern method to achieve this is with The X-Frame-Options response header.
From the MDN:
Take a look at: How to prevent IFRAME from redirecting top-level window
看看这篇文章。 它提供了一个相当简单的解决方案来检测帧并打破它们。
如何使用 JavaScript 打破框架
另外，我会更进一步。 每当您检测到框架时，请获取违规网站框架生成器的附属 ID，并使用 AJAX 将其连同它们正在使用的 URL 推送到服务器。 然后，您可以自动或手动验证他们是否正在构建您的网站，并一次取消一个联盟代码。
Take a look at this article. It offers a fairly simple solution for detecting frames and breaking out of them.
How to Break Out of Frames with JavaScript
In addition, I would take it one step further. Whenever you detect a frame, grab the affiliate ID of the offending site framer, and push that to the server with AJAX along with the URL they are using. Then, either automatically or manually, you can verify that they are framing your site, and cancel their affiliate code one at a time.
只是在这里猜测...但是如果您使用 javascript 调用父窗口来访问其文档对象怎么办？ 你可以检查它是否不为空，如果有一个父窗口（意味着一个框架加载了你的网站），你可以通过javascript隐藏所有的html...
Just guessing here...but what if you use javascript to call your parent window to access its document object ? You could check if its not null, and if there is a parent window (meaning a frame loaded your site), you could hide all your html through javascript...