iframe refuses to display

HtmlIframe

Html Problem Overview


I am trying to load a simple iframe into one of my web pages but it is not displaying. I am getting this error in Chrome:

Refused to display 'https://cw.na1.hgncloud.com/crossmatch/index.do' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' https://cw.na1.hgncloud.com".


Invalid 'X-Frame-Options' header encountered when loading 'https://cw.na1.hgncloud.com/crossmatch/index.do': 'ALLOW-FROM https://cw.na1.hgncloud.com' is not a recognized directive. The header will be ignored.

This is the code for my iframe:

<p><iframe src="https://cw.na1.hgncloud.com/crossmatch/" width="680" height="500" frameborder="0"></iframe></p>

I am not really sure what that means. I have loaded plenty iframes before and never received such errors.

Any ideas?

Html Solutions


Solution 1 - Html

It means that the http server at cw.na1.hgncloud.com send some http headers to tell web browsers like Chrome to allow iframe loading of that page (https://cw.na1.hgncloud.com/crossmatch/) only from a page hosted on the same domain (cw.na1.hgncloud.com) :

Content-Security-Policy: frame-ancestors 'self' https://cw.na1.hgncloud.com
X-Frame-Options: ALLOW-FROM https://cw.na1.hgncloud.com

You should read that :

Solution 2 - Html

The reason for the error is that the host server for https://cw.na1.hgncloud.com has provided some HTTP headers to protect the document. One of which is that the frame ancestors must be from the same domain as the original content. It seems you are attempting to put the iframe at a domain location that is not the same as the content of the iframe - thus violating the Content Security Policy that the host has set.

Check out this link on Content Security Policy for more details.

Solution 3 - Html

For any of you calling back to the same server for your IFRAME, pass this simple header inside the IFRAME page:

Content-Security-Policy: frame-ancestors 'self'

Or, add this to your web server's CSP configuration.

Solution 4 - Html

The same issue appears to me, just don't open the page in a private window.

Solution 5 - Html

In my case it was that the site i was embedding had a specific url for embedding content and a different url for sharing

the url i had set in the iframe was

https://site/share/2432423232

changing it to

https://site/embed/2432423232

worked for me

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionJose M.View Question on Stackoverflow
Solution 1 - HtmlVinceView Answer on Stackoverflow
Solution 2 - HtmlDavidView Answer on Stackoverflow
Solution 3 - HtmlVolomikeView Answer on Stackoverflow
Solution 4 - HtmlEbraheem AlrabeeaView Answer on Stackoverflow
Solution 5 - HtmlWinnipassView Answer on Stackoverflow