For my site I see that among response headers there is X-Frame-Options: SAMEORIGIN. Still I can preview my site in iframe of some different site, for instance here. But I expected not to. I assume that this is back-end work to add some more setting that would prevent the site from rendering in iframe? I thought that if it returns the above header the security functionality preventing showing site in iframe is already in place. Isn't it?

UPDATE: It's my fault I didn't specify that this header is returned for each xhr but there is no such header for static resources (html, js, css, images). Might that be a reason?

UPDATE2: I've asked BE guys to provide the header for static resources too. After implementation I'll share whether it helps or not.

  • it should be working. What browser are you using? – tim Dec 27 '16 at 17:40
  • Your link is just a default w3schools demo. Perhaps you mean to show us different code? – Alexander O'Mara Dec 27 '16 at 17:53
  • @AlexanderO'Mara, no I didint mean to show something different, I just inserted my site link into iframe src attribute in this tutorial for testing purpose – Olena Horal Dec 27 '16 at 18:06
  • @tim it was Chrome Version 55.0.2883.87, also checked in Firefox Version 50.1.0. I thought that its server that is responsible for serving content or not – Olena Horal Dec 27 '16 at 18:10
  • 2
    The server doesn't know whether the page is being requested in an iframe, so it will send the response and the browser checks the headers to see if it's allowed. – Boycott SE for Monica Cellio Dec 27 '16 at 18:50

I asked that the URL be posted so more eyes can examine the header.

If that can't be done, check the following by looking at the header as your browser sees it in the developer tools.

If this header is set more than once, it can cause the directive to fail because the browser will condense multiple instances of the same header into one so that it becomes:


and this value is not one of the three allowed so the header will be ignored.

For example, if your web server sets it and then code in the application sets it again, it will happen.

source: https://blog.qualys.com/securitylabs/2015/10/20/clickjacking-a-common-implementation-mistake-that-can-put-your-websites-in-danger

  • I have a site where this header (with same value) is set twice - looks just like the 'condensed' example (SAMEORIGIN,SAMEORIGIN) and it still works properly in the two browsers I have tested. – user1801810 Dec 28 '16 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.