Ignore X-Frame-Options

[matteodelabre]

It would be intersting if we had a way to ignore X-Frame-Options header, restricting retrieval of pages to same origin.

This restriction leads to this kind of issues : gabceb/atom-web-view#7. node-webkit has a nwfaketop attribute that does the trick.

[adammw]

Would it be possible to implement support for the <webview> tag? Seems like Chrome has a dedicated tag for this kind of thing when used in packaged app. Not sure if that's a feature in Chrome proper or if it's available at all from libchromiumcontent...

[ZeikJT]

I too would appreciate a way around this, atom-shell isn't the typical browser and sometimes needs higher authority.

[abram]

Related to #456 - disabling X-Frame-Options would make it possible to reliably load an arbitrary page into an iframe, and you need to have a page in an iframe to be able to receive window.postMessage events from it.

[abram]

Awesome! Thanks @zcbenz!

[ZeikJT]

@zcbenz Thanks so much! This is going to make life a lot easier 👍

[sgarbesi]

This was removed. Is there another working solution?

[frankhale]

https://github.com/electron/electron/blob/master/docs/api/browser-window.md

webSecurity Boolean - When setting false, it will disable the same-origin policy (Usually using testing websites by people), and set allowDisplayingInsecureContent and allowRunningInsecureContent to true if these two options are not set by user. Default is true.

[sgarbesi]

@frankhale #573

<iframe name="google-disable-x-frame-options" src="https://google.com"></iframe>