VS2013 Cordova插件和Azure网站的X-Frame-Options标头问题

Question

Perhaps I am going about this wrong but here is the situation.

I have a web app that we made in c# mvc5 and AngularJS. All of this works fine. We want to have native apps also, mostly to update our older ios and android apps to the new version.

I installed the cordova tools for VS2013 and that seems to be working but we want to be able to call the same C# controllers to get the data in the native apps.

The issue I am having is that we are hosted on azure and they are forcing the X-Frame-Options header to 'SAMEORIGIN' even when I specifically clear or remove it using the web.config. The best I can get is for it to have both SAMEORIGIN and ALLOW_FROM myuri which is not going to work either.

I have tried to set the domain to the same value as our azure site in the cordova project but it says that is not a valid value.

web.config

<customHeaders xdt:Transform="Replace">
    <clear/>
    <add name="X-Frame-Options" value="ALLOW-FROM myuri" />
  </customHeaders>

I have tried this with and without the transform and in the standard config and the release/debug versions. I also used the remove syntax and that doesnt work either. All of these result in the same result of both values existing. I can only guess that azure is trying to 'protect me from myself'

I have also verified the domain in azure management tools, which is supposed to 'whitelist' it but that doesnt work either.

here is the error that I get in VS:

Refused to display 'http://myuri/Home' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.    

And this when I add ALLOW_FROM:

Multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, ALLOW-FROM  myuri') encountered when loading 'http://myuri/Home

Answer 1

I went through the same problem.

According to the accepted answer of this thread , you have to whitelist the website you want to visit within your app in your config.xml, like this:

<access origin="https://*.domain.fr" />
<allow-navigation href="https://*.domain.fr/*" />

Note that if you run your cordova app within cordova-simulate, this won't work. To check whether it's working or not, you need to use cordova run and test it on your phone.