Django nginx Refused to display in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

Question

I have deployed a django web application on a server with nginx and uwsgi. I can access the site perfectly using the ip address.

I purchased a domain name say abc.example.com and pointed it to my ip address. Now when i go the domain name it loads a blank page and throws an error in browser console:

In Chrome:

Refused to display 'ip address' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

In Mozilla:

Load denied by X-Frame-Options: 'ip address' does not permit cross-origin framing.

The point is I dont have any iframe in my whole Application.

What is this error and how can i solve it?

When i go to application using ip address it works perfectly as it is supposed to be. Then what is the problem with domain? I double checked the settings in dns zone on godaddy but couldn't figure out anything.

Django `settings.py` has `X_FRAME_OPTIONS` parameter. Try changing it's value to `DENY`, according to https://docs.djangoproject.com/ja/1.9/ref/clickjacking/#setting-x-frame-options-for-all-responses . If this will not help, try to disable middleware to see what happens. — Damaged Organic, Jun 08 '16 at 07:20
The error indicates that there is an iframe there. What is the result when you select "show source" in the web browser? — Håken Lid, Jun 08 '16 at 07:22
@ManishGupta: I see... This middleware for some reason thinks that you trying to load your website from a different origin. That clearly points that problem is with GoDaddy configuration. Maybe it's http://stackoverflow.com/questions/22515498/entering-route53-nameservers-gives-me-errors-on-godaddy#comment34263478_22517935 ? — Damaged Organic, Jun 08 '16 at 09:49

score 49 · Answer 1 · edited Jul 26 '17 at 13:19

49

In 'settings.py' file, add these two lines. It may help you.

X_FRAME_OPTIONS = 'ALLOWALL'

XS_SHARING_ALLOWED_METHODS = ['POST','GET','OPTIONS', 'PUT', 'DELETE']

edited Jul 26 '17 at 13:19

Tamás Sengel

55,884
29
169
223

answered Jul 26 '17 at 12:55

J.Jai

597
1
5
9

7

its secure allowall? Can I allow just a specific domain? thanks – GIA Jun 21 '18 at 14:44
Perfect answer. I was looking out for a perfect solution for this error, and you had given the exact answer which I was actually expected. Thank you. – Hitesh Kalwani Jan 29 '21 at 05:35
this exactly what i was looking for.. thanks <3 – Ali Aref Feb 15 '21 at 06:37
11

X_FRAME_OPTIONS = 'SAMEORIGIN' works and is safer. – iniju Jul 09 '21 at 07:03
This work for me. thank you – sylvan kadjo Jan 05 '22 at 21:09

Django nginx Refused to display in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

1 Answers1

Linked