31

I'm using nginx as a reverse proxy for my website.

I want to be able to open my website in an iFrame from a chrome extension new tab html file.

For this, I need my nginx to set X-Frame-Options to allow all domains.

According to this answer, all domains is the default state if you don't set X-Frame-Options.

My /etc/nginx/nginx.conf doesn't have the X-Frame-Options set anywhere.

Yet when I check my website response header using Postman, it shows me X-Frame-Options = SAMEORIGIN.

How can I remove this setting and load my website in an iFrame in the chrome new-tab .html file?

Mallika Khullar
  • 1,725
  • 3
  • 22
  • 37

5 Answers5

48

Solved it by changing proxy_hide_header values in /etc/nginx/sites-available/default file like so:

proxy_hide_header X-Frame-Options;

Needed to restart nginx as well as use pm2 to restart my nodejs server (for some reason, it didn't work till I made a small change to my server and restarted it).

Mallika Khullar
  • 1,725
  • 3
  • 22
  • 37
18

add_header X-Frame-Options ""; did the trick for me in nginx 1.12.

Jonathan
  • 13,947
  • 17
  • 94
  • 123
9

Found this header in /etc/nginx/snippets/ssl-params.conf

Just needed to comment out the line:

# add_header X-Frame-Options DENY;
Stalinko
  • 3,319
  • 28
  • 31
  • 1
    I have nginx 1.18 configured w/ SSL and this did the trick for me. I was getting irritated at all the other answers. – Vincent La Oct 16 '22 at 22:56
3

I found this header option in the file /etc/nginx/templates/default.conf.

add_header  X-Frame-Options "SAMEORIGIN" always;

default.conf file is mentioned in my main nginx.conf file.

p.t3
  • 31
  • 1
  • 1
    As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-ask). – Community Sep 15 '21 at 21:45
  • I have added in /etc/nginx/sites-available/app file (ubuntu 18.04). It works. Thanks buddy – Ramesh Ponnusamy Jun 03 '22 at 12:13
0

maybe you can try adding this in your nginx config

add_header X-Frame-Options "" always;

it works for me

Azam Rizki Maulana
  • 1
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Dec 01 '22 at 16:05