Only allow iframe to load content

问题

I have a service that is loaded through an iframe on exampledomain.org. Ideally, I only want this service to be loaded under exampledomain.org. This I can ensure with X-Frame Options. However I also don't want it be accessible by simply pasting the url into the browser. Is there a way to prevent anything except an iframe from loading content?

回答1:

This will make it only loosely enforced, but you can put a bit of JS on the framed page to take you back to the page you intended them to be on. One check you could try is to see if window.parent is the same as window.

if (window.parent === window) {
    location = "https://exampledomain.org/";
}

来源：https://stackoverflow.com/questions/38247407/only-allow-iframe-to-load-content