Question

我需要为使用firebase托管的页面使用几个iframe，但是它给了我X-Frame-Options错误，其中一个iframe用于在picasa上托管的图库，而anohter ifrmae用于联系表单（因为我无法发送）通过firebase发送电子邮件:(）

这里是错误

Refused to display 'https://get.google.com/albumarchive/pwa/11111/album/1111?source=pwa#slideshow/1111' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.
jquery.min.js:2 Uncaught DOMException: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Blocked a frame with origin "https://demodomain.com" from accessing a cross-origin frame.

我用firebase.json做了这个，但没有工作

 "headers": [
     {
       "source": "**/*",
       "headers": [
         {"key": "X-Content-Type-Options", "value": "nosniff"},
         {"key": "X-Frame-Options", "value": "ALLOW"},
         {"key": "X-UA-Compatible", "value": "ie=edge"},
         {"key": "X-XSS-Protection", "value": "1; mode=block"}
       ]
     }
]

Answer 1

你有正确的想法，你只是设置了错误的价值。对于X-Frame-Options标头，ALLOW不是可接受的值。您可以设置ALLOW-FROM值，然后指定要允许嵌入的uri。请查看下面的更多文档。

FIX：

 "headers": [{
   "source": "**/*",
   "headers": [
     {"key": "X-Content-Type-Options", "value": "nosniff"},
     {"key": "X-Frame-Options", "value": "ALLOW-FROM https://get.google.com"},
     {"key": "X-UA-Compatible", "value": "ie=edge"},
     {"key": "X-XSS-Protection", "value": "1; mode=block"}
   ]
 }]

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

使用X-Frame-Options托管iframe错误的firebase

1 个答案: