Internet Explorer X-Frame-Options ALLOW-FROM 在 IE 11 和 Edge 中不起作用

Question

I am having an issue using X-Frame-Options to embed one site as an iFrame into another (different domains) with IE 11 and Edge. My research and experience indicate that IE doesn't yet support CSP Level 2 frame-ancestors, so I must use X-Frame-Options .

I have added the response header X-Frame-Options: ALLOW-FROM https://<mysite>.com to the site that needs to be embedded.

These are secured sites so I am unable to provide real URLs to this community.

When I launch the main site, which contains an iFrame with content from the second site, I am able to see the X-Frame-Options header in the response for the iframe content and it looks to be applied correctly. However, IE indicates "...modified this page to help prevent cross-site scripting" and my frame contains only the # symbol.

Due to timing and internal IT delays, I am unable to have both sites hosted in the same domain.

Can anyone help to explain what I did wrong in implementing X-Frame-Options or if there is another option to achieve the desired effect?

Answer 1

IE 11 not following standard , which means can not use "*", so have to give domain name with http/https.

  def cors_set_access_control_headers
    headers["Access-Control-Allow-Origin"] = "*"
    headers["Access-Control-Allow-Methods"] = "GET"
    headers["Access-Control-Request-Method"] = "*"
    headers["Access-Control-Allow-Headers"] = "Origin, X-Requested-With, Content-Type, Accept, Authorization"
    headers["X-Frame-Options"] = "ALLOW-FROM http://172.16.1.159"
    headers["X-XSS-Protection"] = "0"
  end

Answer 2

It turns out that the issue wasn't related to frames. The framed content had the same XSS error/note when accessed directly vs through an embedded iframe. The timing of the error showing threw me off since it was coincidental to the implementation of CSP level 2 frame-ancestors.

I have opened a case with MS to determine what in the content the XSS engine doesn't like and have had to disable the XSS in IE browsers with the X-XSS-Protection:0 response header.