2

I have a Wordpress site hosted on LightSail (which uses bitnami). The domain is https://example.com On a subdomain https://sub.example.com I have another server running. On this server, I want to embed a page from the main domain https://example.com/a-page. Currently, I am getting errors that permission is denied.

I have updated the htaccess file like so:

Header set X-Frame-Options "ALLOW-FROM https://*.example.com"
Header set Content-Security-Policy "frame-ancestors 'self' https: *.example.com"
Header set Referrer-Policy "strict-origin-when-cross-origin"

But the headers don't seem to updating or allowing any iframe embeds. I'm not very well-versed on HTTP Headers so apologies if this is a rather silly question.

Thanks!

Improve this question
4
  • 1
    We can't do much without knowing the actual site you are trying this on, maybe looking at the header responses using Chrome DevTools may give you a clue. – Deepak Kamat Nov 25 '20 at 17:41
  • It says that x-frame option is still sameorigin even though I have updated the htaccess file – nbz Nov 25 '20 at 17:50
  • Try restarting Apache server, clearing caches etc. Also WordPress has its own interface for HTTP headers, so check this out - developer.wordpress.org/reference/hooks/wp_headers If setting it through HTACCESS doesn't seem to work simply use meta tags to do the job. – Deepak Kamat Nov 25 '20 at 17:53
  • 1
    "use meta tags to do the job" - You can't use HTML meta tags to embed X-Frame-Options or frame-ancestors directives of the Content-Security-Policy (as stated here) since the browser will ignore them. @DeepakKamat – MrWhite Nov 26 '20 at 19:10
1

I was able to figure out that because Lightsail uses a Bitnami deployment of Wordpress, Bitnami overrides the .htaccess file.

Instead you have to update the /opt/bitnami/apache2/conf/httpd.conf file by adding the following content:

<IfModule headers_module>
    <IfVersion >= 2.4.7 >
        Header always setifempty X-Frame-Options ALLOW-FROM https://*.example.com
    </IfVersion>
    <IfVersion < 2.4.7 >
        Header always merge X-Frame-Options ALLOW-FROM https://*example.com
    </IfVersion>
</IfModule>

Reference: https://docs.bitnami.com/bch/apps/livehelperchat/configuration/enable-framing/

Improve this answer
2
  • Although the Mozilla Docs states that the ALLOW-FROM directive "is an obsolete directive that no longer works in modern browsers. Don't use it." and suggests to use a Content-Security-Policy HTTP header instead with a frame-ancestors directive (your 2nd example). – MrWhite Nov 26 '20 at 17:11
  • Which is precisely why I have raised it on their forums - community.bitnami.com/t/… – nbz Nov 26 '20 at 17:20
0

In your case, I think you should use this code in htaccess file to allow Iframe can load with the same origin:

X-Frame-Options: SAMEORIGIN

For more information you can view on this URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Hope can help you finsihed this problem.

Improve this answer
2
  • That doesn't work as sameorigin also requires you to have the same server. As I mentioned the subdomain is on a different server. – nbz Nov 26 '20 at 9:51
  • may be you site is cache. You clear all cache browser, cache server and test again. – xuan hung Nguyen Nov 26 '20 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.