问题
I have two web applications: web application (web-app) and report web. I want to embedded report web in web-app in a <iframe>
. So it refused by Browser with the error:
X-Frame-Options: DENY
Any help?
回答1:
The value of X-Frame-options can be DENY (default), SAMEORIGIN, and ALLOW-FROM uri. According to Spring Security documentation you can tell Spring to overwrite the default behaviour adding your custom header that way:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.headers()
.addHeaderWriter(new XFrameOptionsHeaderWriter(new WhiteListedAllowFromStrategy(Arrays.asList("www.yourhostname.com"))))
...
}
and Spring shall append X-Frame-Options: ALLOW-FROM ... or
.addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsHeaderWriter.XFrameOptionsMode.SAMEORIGIN))
for X-Frame-Options: SAMEORIGIN or make it completely disable by
http.headers().frameOptions().disable()
回答2:
If you are using Spring Security 4.x the following configuration will solve your problem (assuming the webapp runs on the same server address).
XML configuration:
<http>
<!-- ... -->
<headers>
<frame-options policy="SAMEORIGIN" />
</headers>
</http>
Java configuration:
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
// ...
.headers().frameOptions().sameOrigin();
}
}
Disable Configuration
You could also just disable it, being aware of the security risk.
http.headers().frameOptions().disable();
Background Information
In Spring Security 3.2.0, security headers were introduced, but were disabled by default:
http://spring.io/blog/2013/08/23/spring-security-3-2-0-rc1-highlights-security-headers/
In Spring Security 4.x the headers are enabled by default (for IFrames: X-Frame-Options: DENY):
"Spring Security 4.x has changed both the Java Configuration and XML Configuration to require explicit disabling of defaults."
http://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-jc.html#m3to4-header
source: http://docs.spring.io/autorepo/docs/spring-security/4.0.x/reference/html/headers.html#headers-frame-options
回答3:
You can use
<headers>
<frame-options policy="SAMEORIGIN"/>
</headers>
inside your <http>
configuration in your security application context XML
来源:https://stackoverflow.com/questions/28058878/allow-web-page-to-be-rendered-inside-html-frame