We have a requirement to embed a URL of a third party site in an Iframe, into our AEM site. The third party URL uses "HTTP" scheme.
Since our site uses “HTTPS” scheme , when the page is loaded, it is prompting for “Load Unsafe script” and the iFrame is rendered only if we accept it.
(We have tried to provide some sample url with “https“ scheme within iFrame, but in that case content is not getting displayed due to “X-FRAME OPTION” header set to “Same Origin” in our site.)
Is there any way to load the content directly in the page without prompting for “load unsafe script” ? Please advise.
I am not sure if it is allowed.
But some workarounds i found out are:
https://mysite.com That has a iframe linking to...
https://mysite.com/utilities/redirect.html Which has a simple js redirect script like...
2. "https://www.google.com/search?q=%http://yourhttpsite.com&btnI=Im+Feeling+Lucky" [use google as the ssl proxy, tested on ]
3. You could add an RSS feed or write some reader/parser to read the http site and display it within your https site.
I also let other community member to comment here.
Thanks for your comments.
We will not be able to follow the first approach since we have to embed the URL in our page, not redirect.
Whether the second approach is applicale for "http" scheme? The URL to be embed is in "http".
The problems you are facing are the drawbacks of using an iframe. I see to 2 different options
Thanks For your comments.
We cant change the X-FRAME OPTION.
Instead of iFrame, we tried Embed using <object> </object> , but it is also prompting to "load unsafe script".
Please suggest if you have any other options.
Your only solutions are to either :
Modern browsers doesn't allowed insecure content(serve over HTTP) inside secure pages(HTTPS)