如何防止整个网站加载iframe除了一页 [英] How to prevent whole site to load in iframe except one page

问题描述

我已经实现了一个asp.net MVC网站。我想阻止整个网站加载iframe除了一页。我在网络配置下添加了以下代码。

< httpProtocol> 
< customHeaders> 
< add name =X-Frame-Optionsvalue =SAMEORIGIN/> 
< / customHeaders> 
< / httpProtocol> 

我尝试过：



这个web配置代码阻止整个网站加载到iframe中。我尝试从视图中删除'X-Frame-Options'选项，只有我想允许iframe

公共ActionResult广告（）
 {
 Response.Headers.Remove（X-Frame-Options）; 
 return View（）; 
} 
 

但是当我运行此代码时，X-Frame-Options未从标题中删除。请建议我该怎么办？

解决方案

在配置文件中使用< location> 标签修改该操作的标头：

 <   system .webServer  >  
 <   httpProtocol  >  
 <   customHeaders  >  
 <   add     name   =   X-Frame-Options    value   =  SAMEORIGIN    /  >  
 <   / customHeaders  >  
 <   / httpProtocol  >  
 <   / system.webServer  >  
 
 <   location     path   =  YourController / Ads >  
  <   system.webServer  >  
 <   httpProtocol  >  
 <   customHeaders  >  
 <   remove    名称  =  X-Frame-Options    /   >  
 <   / customHeaders  >  
 <   / httpProtocol  >  
 <   / system.webServer  >  
 <   / location  >  

I've implemented an asp.net MVC site. I want to prevent the whole site to load in the iframe except one page. I added below code under web config.

<httpProtocol>
      <customHeaders>
        <add name="X-Frame-Options" value="SAMEORIGIN" />
      </customHeaders>
    </httpProtocol>

What I have tried:

This code of web config prevents the whole site to load in the iframe. I try to remove 'X-Frame-Options' option from the view where only I want to allow the iframe

public ActionResult Ads()
       {
           Response.Headers.Remove("X-Frame-Options");
           return View();
       }

But when i run this code X-Frame-Options not removed from header. Please suggest me what can I do?

解决方案

Use a <location> tag in the config file to modify the headers for that action:

<system.webServer>
    <httpProtocol>
        <customHeaders>
            <add name="X-Frame-Options" value="SAMEORIGIN" />
        </customHeaders>
    </httpProtocol>
</system.webServer>

<location path="YourController/Ads">
    <system.webServer>
        <httpProtocol>
            <customHeaders>
                <remove name="X-Frame-Options" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</location>

这篇关于如何防止整个网站加载iframe除了一页的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！