Expand my Community achievements bar.

Dive into Adobe Summit 2024! Explore curated list of AEM sessions & labs, register, connect with experts, ask questions, engage, and share insights. Don't miss the excitement.
SOLVED

X-Frame-Options: SAMEORIGON issue

Avatar

Level 3

Hi All,

I have developed my application on AEM6.4 and now I need to access my application by another application through iframe, when I am trying to access my AEM application through iframe, I am getting below error:

sunily21159739_0-1639694198485.png

as expected X-Frame-Options: SAMEORIGON

I have updated configuration at dispatcher level like:

X-Frame-Options: ALLOW-FROM https://mynonaemapplication.com

but after updating like this, it allows to all other applications to access my AEM application by iframe and looks like not recommended or not secure.

Please advice how can I access my AEM application by other application through iframe.

 

Thanks

 

1 Accepted Solution

Avatar

Correct answer by
Community Advisor

Hi,

You can add this at code or dispatcher/apache level as well.

The easiest is to add at apache level.

x-frame-options: https://mynonaemapplication.com


Arun Patidar

View solution in original post

12 Replies

Avatar

Level 2

try checking on the Apache Sling Referrer filter where in you can restrict who get to access your AEM env.

 

The Sling Referrer Filter {#the-sling-referrer-filter}

To address known security issues with Cross-Site Request Forgery (CSRF) in CRX WebDAV and Apache Sling you need to add configurations for the Referrer filter in order to use it.

The referrer filter service is an OSGi service that allows you to configure:

  • which http methods should be filtered

  • whether an empty referrer header is allowed

  • and a list of servers to be allowed in addition to the server host.

    By default, all variations of localhost and the current host names the server is bound to are in the list.

Source: experience-manager-65.en/security-checklist.md at master · AdobeDocs/experience-manager-65.en · GitH...

 

Good Luck

Abdul

Avatar

Level 3

thanks Abdul, in our case we are using multitenant architecture and three applications running on the same AEM instance, is it safe to do update on OSGI level?

 

 

 

Regards 

Avatar

Community Advisor

Hi,

You should do this site level as well, for your site or subsite add below header

 

x-frame-options: https://mynonaemapplication.com https://external2.domain.com

 

 



Arun Patidar

Avatar

Level 3

Hi Arun,

Thanks for the response, do I need to add this "

x-frame-options: https://mynonaemapplication.com https://external2.domain.com

" at dispatcher level or on code level?

 

Avatar

Correct answer by
Community Advisor

Hi,

You can add this at code or dispatcher/apache level as well.

The easiest is to add at apache level.

x-frame-options: https://mynonaemapplication.com


Arun Patidar

Avatar

Level 1

Hi @arunpatidar ,

What can we do in case of Author where apache/dispatcher config is not available for AEM Author as cloud service, it is only configurable for publish instances.

I want to embed author URL in iframe (using acs common integration of AEM assets with MS office).

Avatar

Community Advisor

AEM as a cloud service, the author is always behind the dispatcher, you can add that header easily from dispatcher config file.



Arun Patidar

Avatar

Level 1

@arunpatidar, In all the documents available from Adobe I could see they have mentioned how you can configure your dispatcher with publish instance, nothing is there for Author (as cloud service). You can also check this architectural diagram available in the official documents.. 

ShifGRO23_0-1691494201039.png

 

Avatar

Community Advisor

I also can't see that, but I think you access author via domain not with IP:PORT, so it goes via dispatcher, can you try adding those in author vhost file.



Arun Patidar

Avatar

Community Advisor

@sunily21159739 Please try this below rule by adding in virtual host file:

Header always append X-Frame-Options "ALLOW-FROM  http:// <external domain.com>"

 

Regards,

Raja