As "suddenly" usually means "after a change" ... was there a change to the site.. Any idea what changed?

Thanks for your reply - I am trying to find what might have changed, but I don't see anything that seems relevant.

Do you know if there is anything I should be looking for in the web.config or elsewhere?

I see "Refused to display 'https://www.santacruzcounty.us/' in a frame because it set 'X-Frame-Options' to 'sameorigin'."
in the Console which tells me the references (internet) site has a setting somewhere for x-frame origins. It's not in the web.config or in IIS (that I can see).
Do you know where else I could look?

Thanks

Tom

From: https://stackoverflow.com...ions-to-sameori?rq=1

You cannot display a lot of websites inside an iFrame. Reason being that they send an "X-Frame-Options: SAMEORIGIN" response header. This option prevents the browser from displaying iFrames that are not hosted on the same domain as the parent page. This is a security feature to prevent click-jacking. Some details at How to show google.com in an iframThate?

That last sentence points to:  https://stackoverflow.com...gle-com-in-an-iframe

 

It seems like the change you are looking for occured on the source of what you want to iframe ...

Thanks, Joe - I saw that too.

Do you know where I would look on the source of the reference site to find where the 'X-frame-options" is being set?

Tom

No. But, you might use Fiddler to see what your site is sending to request the data.

Do you control that site?

Posted By Tom Melkonian on 04 Nov 2019 02:30 PM
Thanks, Joe - I saw that too.

Do you know where I would look on the source of the reference site to find where the 'X-frame-options" is being set?

Tom

Tom,

that is set on the web server that hosts the site. If you have control over it, you might use a CSP instead of the X-Frame-Options to allow your site to display it. See here for details.

If not I guess chances are low to get the page in an IFrame. You could provide a link instead to open the page in a new window - or a JavaScript to do that automatically.

Happy DNNing!
Michael

Thanks Michael - Just to be clear - do you mean the web server of the site with the iFrames, or the web server of the content being pulled up by the iFrames?

I have access to both. It's an intranet site with iFrames trying to pull up content from our internet site. The weird thing is that it stopped working but it doesn't look like anything changed on the site /server.

Another weird thing is that there is one iFrame that is still working - It's pulling content from the same webserver / website, but just some straight html in a folder (not inside DNN) Which is what makes me think the problem is inside DNN somehow.

-Tom

 

Tom,

I was talking about the web server of the content being pulled up by the iFrames.

If using the HTTP response header (X-FRAME-OPTIONS), you have either the possibility to remove it - then all other websites can display the content in an IFrame. If it is an intranet server, it should not be too much risk. Or you can use the ALLOW-FROM option and define the webserver with the IFrames there. The disadvantage of the header is that you may only define one allowed source.

If you need to allow more sources you have to define a CSP on the server containing the content displayed in the IFrames.

To understand this setting - or the risk when it is not set - I recommend watching my video about clickjacking: https://www.youtube.com/watch?v=C70VPgkV6gk

Happy DNNing!
Michael

Thanks Michael -

I actually did remove the custom header (X-Frame-Options) setting from the intranet site, and the iFrames still don't show.

So, neither of the sites have the X-Frame-Options setting in their web.config, but the iFrames still don't work.

-Tom