iFrame from sub-domain: Refused to display

mikek 2014-12-10 17:25:01 UTC #1

I am using the Bitnami Moodle Version 2.8.1 through AWS.

I am trying to display content from a sub-domain through an iFrame and am getting a console.log error message of "Refused to display 'http://subdomain.myCompany.com/index.php' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'."

I have been doing a lot of reading and it sounds like the X-Frame-Options is deprecated and that I should be controlling things through Content-Security-Policy and frame-ancestors.

I have no experience with apache web servers. How do I allow content from a sub-domain to load into an iFrame on my moodle site?

Thank you

Iframe images are getting blocked on chrome

marcos 2014-12-11 11:45:50 UTC #2

Hi @mikek,

In this case you enable the best choice for you will be to modify Moodle's source code (which you'll have to apply every time you upgrade Moodle):

First, open the following file:

your_installation_directory/apps/moodle/htdocs/lib/weblib.php

At line 2032, you will see the following line:

        @header('X-Frame-Options: SAMEORIGIN');

You can try replacing it by:

        @header('X-Frame-Options: SAMEORIGIN, GOFORIT');
        @header("Content-Security-Policy: default-src 'self' *.yourdomain.com");

You can read more about Content-Security-Policy here.

Regards

mikek 2014-12-11 20:46:13 UTC #3

Marcos,

Do I need to reboot the Apache server after updating this code?

marcos 2014-12-11 23:04:55 UTC #4

Hi @mikek,

No, it is not necessary to restart your Apache server after modifications done to your PHP files.

Regards

abhishekchouhan 2016-09-20 00:13:06 UTC #5

Hi,
I am using Moodle 3.1.2-0 (64-bit).
Still facing same issue with SAMEORIGIN.

I tried to weblib.php code as mention in the forum. Even though it is not working.

I tried to comment complete code related to sameorigin in weblib.php, even though getting same issue.

I want to completely bypass this header. How can we do that?

--
Thanks
Abhishek Chouhan

abhishekchouhan 2016-09-20 03:22:54 UTC #6

In httpd.conf there was a check if X-Frame-Options is empty then set to SAMEORIGIN.

This was the issue. commented that configuration..

All Good Now.

jsalmeron 2016-09-23 13:07:09 UTC #7

Hello @abhishekchouhan ,

We are glad that you were able to fix the issue

Best regards,

Javier J. Salmerón

shoebahmed 2017-10-16 09:49:29 UTC #8

@abhishekchouhan
Thanks this also fixed my issue for Wildfly Provided by Bitnami.

I am running 3 applications on wildfly sever. With different context root.

/
/context1
/context2

This works fine when I access the application. But when I used URL Forwarding from DNS, context1 and context2 where not working.

By commenting X-Frame-Options for apache2 it worked.

michiel 2017-10-16 11:56:41 UTC #9

Hi @shoebahmed,

Thank you for sharing your findings with the community.

Regards,
Michiel D'Hont

michiel 2017-10-16 11:56:48 UTC #10

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!