如何绕过 X-Frame-Options: SAMEORIGIN HTTP 标头？
我正在开发一个网页，需要在 iframe 中显示由另一家公司的 SharePoint 服务器提供的报表。他们对此很满意。
我们尝试在 iframe 中渲染的页面为我们提供了 X-Frame-Options: SAMEORIGIN ，这会导致浏览器（至少 IE8）拒绝渲染框架中的内容。
首先，这是他们可以控制的事情还是 SharePoint 默认情况下所做的事情？如果我要求他们关掉这个功能，他们能做到吗？
其次，我可以做些什么来告诉浏览器忽略这个 http 标头并只渲染框架吗？
I am developing a web page that needs to display, in an iframe, a report served by another company's SharePoint server. They are fine with this.
The page we're trying to render in the iframe is giving us X-Frame-Options: SAMEORIGIN which causes the browser (at least IE8) to refuse to render the content in a frame.
First, is this something they can control or is it something SharePoint just does by default? If I ask them to turn this off, could they even do it?
Second, can I do something to tell the browser to ignore this http header and just render the frame?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
至于第二个问题 - 您可以使用 Fiddler 过滤器来设置响应
X-Frame-Options 标头手动更改为ALLOW-FROM *之类的内容。但是，当然，这个技巧只对您有效 - 其他用户仍然无法看到 iframe 内容（如果他们不这样做）。As for second question - you can use Fiddler filters to set response
X-Frame-Optionsheader manually to something likeALLOW-FROM *. But, of course, this trick will work only for you - other users still won't be able to see iframe content(if they not do the same).是的，Fiddler 对我来说是一个选项：
CustomRules.js）。OnBeforeResponse添加以下行：
Yes Fiddler is an option for me:
CustomRules.js).OnBeforeResponseAdd the following lines:
X-Frame-Options 标头是在浏览器级别强制执行的安全功能。
如果您可以控制您的用户群（公司应用程序的IT部门），您可以尝试类似greasemonkey脚本的东西（如果您可以a）在每个人中部署greasemonkey并b）以共享方式部署您的脚本）...
或者，你可以代理他们的结果。在您的服务器上创建一个端点，并让该端点打开与目标端点的连接，然后简单地向后传输流量。
The X-Frame-Options header is a security feature enforced at the browser level.
If you have control over your user base (IT dept for corp app), you could try something like a greasemonkey script (if you can a) deploy greasemonkey across everyone and b) deploy your script in a shared way)...
Alternatively, you can proxy their result. Create an endpoint on your server, and have that endpoint open a connection to the target endpoint, and simply funnel traffic backwards.
如果第二家公司很高兴您在 IFrame 中访问他们的内容，那么他们需要取消限制 - 他们可以在 IIS 配置中相当轻松地做到这一点。
您无法采取任何措施来规避它，并且任何有效的措施都应该在安全修补程序中快速修复。如果源内容标头表示框架中不允许，则您无法告诉浏览器仅渲染框架。这将使会话劫持变得更容易。
如果内容只是 GET，您不回发数据，那么您可以获取页面服务器端并代理没有标头的内容，但任何回发都应该无效。
If the 2nd company is happy for you to access their content in an IFrame then they need to take the restriction off - they can do this fairly easily in the IIS config.
There's nothing you can do to circumvent it and anything that does work should get patched quickly in a security hotfix. You can't tell the browser to just render the frame if the source content header says not allowed in frames. That would make it easier for session hijacking.
If the content is GET only you don't post data back then you could get the page server side and proxy the content without the header, but then any post back should get invalidated.
更新：2019-12-30
更新 2019-01-06： 您可以绕过
X-Frame-Options使用我的 X-Frame-Bypass< 的/strong> Web 组件。它通过使用多个 CORS 代理来扩展 IFrame 元素，并在最新的 Firefox 和 Chrome 中进行了测试。您可以按如下方式使用它：
（可选）包含 带有内置扩展 polyfill 的自定义元素 对于 Safari：
包含 X-Frame-Bypass JS 模块：
插入 X-Frame-Bypass 自定义元素：
UPDATE: 2019-12-30
UPDATE 2019-01-06: You can bypass
X-Frame-Optionsin an<iframe>using my X-Frame-Bypass Web Component. It extends the IFrame element by using multiple CORS proxies and it was tested in the latest Firefox and Chrome.You can use it as follows:
(Optional) Include the Custom Elements with Built-in Extends polyfill for Safari:
Include the X-Frame-Bypass JS module:
Insert the X-Frame-Bypass Custom Element: