The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Hello,
I'm trying to embed a page from Drupal via Iframe.
In the 7.50 Version, default by emitting the 'X-Frame-Options: SAMEORIGIN' header has been added. (https://www.drupal.org/node/2735873).
I'm trying to override this behavior in a page but it fails on FF & IE, and works well in Chrome.
My Steps are:
1. Make sure cache are enabled.
2. Implement hook_page_alter() and remove this behavior - header_remove('X-Frame-Options');
3. Add iframe in other external web a page from Drupal.
Iframe will show well on Chrome, in IE (my IE version is 11) it shows:
This content cannot be displayed in a frame
To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame.
Anyone had this issue? It seems like it's the cache system, since if i disable caching it works.
Thanks in advance.
Comments
Comment #2
bhavikshah9 commentedHi @tamarpe,
Why are you removing the header completely? Instead, try to set the value of this header to "ALLOW-FROM ".
Moreover, please refer this OWASP document
Comment #3
adam_ commentedI ran into this issue and found this post, I wanted to add some info in case someone came in from search results.
The "ALLOW-FROM" header would be the best way to go about it once it's supported by all major browsers. Currently, it is not universally supported, at least as of this writing. See the support on the MDN web docs. Chrome, Edge and Opera have no support.
You can disable the header in Apache with a setting in the .htaccess file, but this will kill it site-wide.
Header unset X-Frame-OptionsYou can conditionally set it for a page as well.
SetEnvIf Request_URI ^path/to/open/page$ clickjackableHeader unset X-Frame-Options env=clickjackableComment #6
quietone commentedUpdating tags per Issue tags field and Issue tags -- special tags and for issue #3565085: Drupal core issue tag cleanup.