7

I'm getting an error while using an i-frame in angular. It refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin'

Refused to display 'https://docs.google.com/gview?url=https://subtreebucket.s3.amazonaws.com/docsFile_1559124133664_dummy.pdf' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Community
  • 1
  • 1
Abhijeet Srivastava
  • 163
  • 1
  • 2
  • 8
  • 3
    Btw, you should make your S3 bucket private right now, it is public for now and we can access all your files simply by visiting https://subtreebucket.s3.amazonaws.com/. Work on authorizations before putting stuff on it. – Qortex May 31 '19 at 08:13

4 Answers4

1

You cannot overrule that: as you can see in the response to the GET request for the url you are showing, there is a response header x-frame-options: SAMEORIGIN.

It means that the origin server does not authorize you to show this content inside an iframe.

You cannot circumvent this, this is a security protection: otherwise it would make session hijacking too easy.

The only way to go is to have the same resource with an URL that allows you to be viewed (such as the PDF url directly, here https://subtreebucket.s3.amazonaws.com/docsFile_1559124133664_dummy.pdf, or adding embedded=true to the URL might work, which is google docs specific).

Qortex
  • 6,470
  • 3
  • 37
  • 58
1

Please use santizer with safe pipe and then include the link as below

<iframe class="doc" src="https://docs.google.com/gview?url=https://subtreebucket.s3.amazonaws.com/docsFile_1559124133664_dummy.pdf&embedded=true"></iframe>

Make sure you are using embedded=true while adding source in the iframe. It'll definitely work

VIKAS KOHLI
  • 7,314
  • 3
  • 48
  • 49
0

How about stripping away the https://docs.google.com/gview?url= part from the src url?

<iframe 
  src="https://subtreebucket.s3.amazonaws.com/docsFile_1559124133664_dummy.pdf"
  frameborder="0">
</iframe>

It works.

Here's a Working Sample StackBlitz for your ref.

SiddAjmera
  • 35,416
  • 5
  • 56
  • 100
-2

you can use the target="_blank" attribute.

Broken Man
  • 1
  • 3
    your answer can be made more clearer by mentioning why you are making this suggestion, otherwise, it can be posted as a coment – sonali Jan 17 '21 at 03:54