X-Frame-Options标头和Google Analytics（分析）“页内分析”

Question

At present we cannot use Google Analytics "In-page analytics" (it uses an iframe). This is due to the fact that we have set the X-Frame-Options header within our application to “same-origin”, is there any way we can allow Google Analytics to load the website in an iFrame but not allow any other websites?

Thanks in advance,

Adam

Answer 1

Yes, but not in Chrome as there is no support for ALLOW-FROM in X-Frame-Options.

Anyway, there is an newer alternative that is cross-browser compatible and that you should research more:

Content-Security-Policy: frame-ancestors domain.com