如何在Django中配置X-Frame-Options以允许iframe嵌入一个视图? [英] How to configure X-Frame-Options in Django to allow iframe embedding of one view?

问题描述

我正在尝试使django允许将一个特定的视图嵌入到外部站点上，更希望不受站点限制.

I'm trying to enable django to allow one specific view to be embedded on external sites, preferabilly without sites restrictions.

在我的 views.py 文件中，添加了以下代码，其中视图 futurebig 是我要启用的视图:

In my views.py file, I have added the following code, where the view futurebig is the one I want to enable to be embedded:

from django.views.decorators.clickjacking import xframe_options_sameorigin
...
@xframe_options_sameorigin
def futurebig(request):
    ...
    return render_to_response('templates/iframe/future_clock_big.html', context_dict, context)

据我所知这无济于事，因为它仅允许嵌入同一台服务器中.

which doesn't help as I understand because it only enables embedding in the same server.

如何为该特定视图设置标题，以使其可以嵌入到任何网站中?

How can I set the headers for that specific view to enable it to be embedded in any website?

出于记录，我只是前端开发人员，开发该网站的后端开发人员不再与我合作，并且拒绝记录其代码，因此，如果有人可以帮助我并仔细解释我在哪里以及进行了哪些修改，应该做的，我会非常重视.

For the record, I'm just a frontend developer, the backend developer who developed the site is no longer working with me and refused to document his code, so, If anyone could help me and explain carefully where and what modifications I should do, I'll apreciatte it very much.

谢谢.

据我所知，Django版本是1.6

As far as I know, the Django version is 1.6

推荐答案

您正在朝正确的方向前进，但是要实现这一目标所需的确切装饰器是'xframe_options_exempt'.

You are going in the right direction, but exact decorator which you will need to achieve this is 'xframe_options_exempt'.

from django.http import HttpResponse
from django.views.decorators.clickjacking import xframe_options_exempt

@xframe_options_exempt
def ok_to_load_in_a_frame(request):
    return HttpResponse("This page is safe to load in a frame on any site.")

PS:不再支持DJango 1.6.现在是升级的好时机.

PS: DJango 1.6 is no longer supported. It is good time to get an upgrade.

这篇关于如何在Django中配置X-Frame-Options以允许iframe嵌入一个视图?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！