0

I want to host a webpage that can only be served via iframes within my own domain.

An example of this in the wild would be Codepen. They sandbox the content of a "pen" in an iframe, but if you try to load the url from a browser it responds with an empty page.

I understand there might be multiple answers to this question but I'm hoping someone could point me in the right direction.

Would I be checking the referrer server side? Are there any other options?

Pure Function
  • 2,129
  • 1
  • 22
  • 31

1 Answers1

2

Referer is a good start for the server side.

Also you can try using CORS headers: Only allow iframe to load content

Or validating using client side javascript code: How to identify if a webpage is being loaded inside an iframe or directly into the browser window?

Also check info about referrerpolicy https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-referrerpolicy

F.Igor
  • 4,119
  • 1
  • 18
  • 26