Use X-frame-options to prevent cross-domain iframe submissions from being dropped by an IFRAME

refused to display ' http://www.***.com/login/dologin.html ' on a frame because it set ' x-frame-options ' to ' sameorigin ‘.

Trigger reason: The return header of the page is set x-frame-options Sameorigin and can only be referenced by an IFRAME of the same origin. The IFRAME across the domain cannot be displayed.

Workaround:
The first step is to remove the X-frame-options header from the server.

The second step is to add the following code to the page header that you do not want to be IFRAME.
<style id= "Anticlickjack" >body{display:none!important;} </style>
<script>
if (self = = = top) {
var anticlickjack = document.getElementById ("Anticlickjack");
AntiClickjack.parentNode.removeChild (Anticlickjack);
} else {
Top.location = self.location;
}
</script>

Other:

X-frame-options Allow-from only support single domain name to support multiple level two domain name of this non-solution

Not all browsers support this header so the lower version of the browser will still be successful with the IFRAME

Reference: http://www.css88.com/archives/5141

Browsers supporting X-frame-options
Http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

• ie8+
• Opera 10.50+
• Safari 4+
• Chrome 4.1.249.1042+ (Allow-from not yet supported)
• Firefox 3.6.9 (or earlier with NoScript)

cannot be set through <meta http-equiv= "x-frame-options" content= "Sameorigin" > This form in the header of document, only via HTTP header.

Browsers ignore the header if speicified in the META tag. So the following would be META ignored:

<metahttp-equiv="X-Frame-Options"content="deny">

Prevent the IFRAME: put the code in your header

<style id= "Anticlickjack" >body{display:none!important;} </style>
<script>
if (self = = = top) {
var anticlickjack = document.getElementById ("Anticlickjack");
AntiClickjack.parentNode.removeChild (Anticlickjack);
} else {
Top.location = self.location;
}
</script>
Refer to this post
https://www.codemagi.com/blog/post/194

For additional references on Click Hijacking and IFRAME:

Http://javascript.info/tutorial/clickjacking

Http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

Https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

URLs with Chinese requests may return 400 requiring encodeuricomponent processing. Especially when using IE.

Use X-frame-options to prevent cross-domain iframe submissions from being dropped by an IFRAME