Nginx使用X-Frame-Options防止被iframe跨域

Posted 2021-11-21 一百个小排

Refused to display http://www.***.com/org/*** in a frame because it set X-Frame-Options to SAMEORIGIN. 触发原因：页面的返回头被设置 X-Frame-Options SAMEORIGIN ，只能被同源的iframe 引用。跨域名的iframe 没法显示了。

nginx 在 http://www.

***.com/org/ location下增加      

proxy_hide_header X-Frame-Options;

     add_header X-Frame-Options "ALLOW-FROM https://www.***.com/" always;

即可

server location 配置

location / {

     proxy_pass ​​http://192.168.0.206​​;

     proxy_hide_header Vary;

     proxy_hide_header X-Powered-By;

     proxy_hide_header X-Frame-Options;

     add_header X-Frame-Options "ALLOW-FROM ​​http://www.***.com:8181" always;

}