I'm trying to embed an iframe in another site (or rather the other site requires an iframe be embedded showing my Drupal site). I am getting the error:

Load denied by X-Frame-Options: https://example.com/audio/embed/44?autoplay=1&auto_play=true does not permit cross-origin framing.

Request headers:

Host: www.example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://cards-dev.twitter.com/preview/html?authenticity_token=6c647c45ab69f55e843ef827a95377d1b39aab85&url=https%3A%2F%2Fwww.example.com%2Fpodcasts%2Fwho-goes-vegas-stays-vegas-making-mike-american-again&platform=Swift-12&authenticity_token=6c647c45ab69f55e843ef827a95377d1b39aab85&authenticity_token=6c647c45ab69f55e843ef827a95377d1b39aab85
Cookie: AMP_ECID_GOOGLE=amp-F76p47lSL8DdI7QAfmPw264-1cM51dzy1g2eqpVFbsVsDjqrf-h27aVLhYsKepvC; SSESSbc77b3dd795094a7a765da9aeed8de88=JhaX78fzqbvJgmHT02ebpBDJNwN56qgE1sqg45knj_Y
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1

Response headers:

Accept-Ranges: bytes
Cache-Control: must-revalidate, no-cache, private
Content-Encoding: gzip
Content-Language: en
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Apr 2017 19:02:53 GMT
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Server: LiteSpeed
Set-Cookie: SSESSbc77b3dd795094a7a765da9aeed8de88=JhaX78fzqbvJgmHT02ebpBDJNwN56qgE1sqg45knj_Y; expires=Wed, 10-May-2017 22:36:13 GMT; Max-Age=2000000; path=/; domain=.www.example.com; secure; HttpOnly
Surrogate-Control: no-store, content="BigPipe/1.0"
Vary: Accept-Encoding
X-Accel-Buffering: no
X-Content-Type-Options: nosniff
X-Drupal-Dynamic-Cache: HIT
X-Firefox-Spdy: h2
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
x-generator: Drupal 8 (https://www.drupal.org)

Does anyone know how to permit X-Frame-Options so that an iframe with Drupal content can be shown on another site?

  • Can you provide the HTTP request and response headers?
    – mradcliffe
    Commented Apr 17, 2017 at 18:55
  • Hmm, I don't see where the cors module would support iframe embedding. Either the web server (apache, nginx, whatever) or a Drupal module needs to set the X-Frame-Options header: developer.mozilla.org/en-US/docs/Web/HTTP/Headers/…. In addition, the I don't see the cors module adding any other headers.
    – mradcliffe
    Commented Apr 17, 2017 at 19:36
  • 2
    Yes, this is not connected to CORS, you have to remove the header X-Frame-Options: SAMEORIGIN, that drupal sets by default, see drupal.stackexchange.com/questions/188924/…
    – 4uk4
    Commented Apr 17, 2017 at 19:52


Browse other questions tagged or ask your own question.