Apache X-Frame-Options Allow-From multiple domains

Question

I got a error when i using x-frame headers option with apache.

Header always append X-Frame-Options ALLOW-FROM site1,site2,site3

or

Header always append X-Frame-Options ALLOW-FROM=site1,site2,site3

or

Header always append X-Frame-Options ALLOW-FROM=site1
Header always append X-Frame-Options ALLOW-FROM=site2
Header always append X-Frame-Options ALLOW-FROM=site3

How could i set the X-Frame-Options: ALLOW-FROM to support more than a single domain?

Thanks!

Hackbut

Answer 1

Header always append X-Frame-Options ALLOW-FROM=site1
Header always append X-Frame-Options ALLOW-FROM=site2
Header always append X-Frame-Options ALLOW-FROM=site3

This way is OK.
But I got an error when i first using it.
Maybe i make a wrong character.

Hackbut

How do you that in PHP? is it possible to wrapped inside a for loop to have multiple headers and how? – Merrygoround

Answer 2

It's worth noting that ALLOW-FROM is being removed from Firefox 70, and other browsers are likely to follow. You will want to use CSP's frame-ancestors directive instead, which is supported in about 99% of browsers.

Your example would then be:

Header always append Content-Security-Policy "frame-ancestors site1 site2 site3;"

EDIT: frame-ancestors overwrites X-FRAME-OPTIONS in new browsers, so theroetically you could set a value for old browsers in there and have CSP overwrite it in new browsers, but the problem is that there is no X-FRAME-OPTIONS value that will let you be embedded in multiple webpages. The only valid options are deny (not allowed anywhere), sameorigin (your website only) and allow-from (removed from modern browsers, only allowed one site anyway).

The old X-FRAME-OPTIONS value that you want to overwrite is none at all. That will allow you to embed your site in multiple other sites (all of them) and restrict it to the sites you allow in modern browsers.

If not embedding in disallowed sites is more important than embedding in allowed sites, then combine the above with:

Header always append X-Frame-Options "DENY"

That will prevent your site being embedded in all sites in about 3% of browsers, shown only in the allowed sites in 95% of browsers, and shown everywhere in the remaining 0.1% (even X-FRAME-OPTIONS isn't supported everywhere).

Carrissa

while true the answer is needed for thos 10% that are especially required by big enterprises – Hetero

@ref There isn't an X-FRAME-OPTIONS value that will let you embed in multiple sites - I've updated my answer with more information. – Carrissa

Answer 3

EDIT 17/01/2018 : This is what is correct :

Header set X-Frame-Options SAMEORIGIN
Header append X-Frame-Options "ALLOW-FROM http://www.example.com/"  
Header append X-Frame-Options "ALLOW-FROM http://example.com/"
Header append X-Frame-Options "ALLOW-FROM https://www.example.com/"
Header append X-Frame-Options "ALLOW-FROM https://example.com/"

So basicaly you only allow iframes from your site (SAMEORIGIN) and you specify with an "append" a list of allowed url. if you don't add the "append" each line will overwrite the previous one.

This actually works with internet explorer 11, doesn't work in Firefox 57, and is ignored by Chrome...

testing with https://securityheaders.io will not give you a "A" because they can't handle multiple uri

We couldn't detect a valid configuration. Expected values are "DENY", "SAMEORIGIN", "ALLOW-FROM (URL)" and "ALLOWALL".

Another possibility which seems to work in IE11 and Firefox is :

 Header always set X-Frame-Options "ALLOW-FROM https://www.example.fr/ https://example.fr/ http://www.example.fr/ http://example.fr/"

It gives a "A" when you check the result with https://securityheaders.io

By the way i'm wondering what's the point of using a security setting that you can bypass using the most used browser in the world (Chrome) ??

Prather

Thank you! Your post lead me to uncover that I had been using set instead of append – Treadway

I get Invalid 'X-Frame-Options' header encountered when loading 'http://<ipa>:8080/wordpress/': 'ALLOW-FROM http://<ipa>:8080/wordpress/' is not a recognized directive. The header will be ignored – Laccolith

did you enable the mod_headers in apache ? can you give more details about your configuration ? – Prather

These do not work in Internet Explorer 11. A page from a site that returns the headers for your first configuration example can be successfully framed by any site. A page from a site that returns the headers from your second configuration example will only allow framing by https://www.example.fr (i.e. the first site that appears in your header). It's not sufficient to test with securityheaders.io. You actually need to test your page framed by a page from a domain you don't want to allow framing. – Overtop

Answer 4

SetEnvIf Referer "^(https:\/\/.*\.example1\.com)/.*" X_FRAME_OPTIONS_ALLOWED=$1
SetEnvIf Referer "^(https:\/\/.*\.example2\.com)/.*" X_FRAME_OPTIONS_ALLOWED=$1

Header set X-Frame-Options SAMEORIGIN
Header append X-Frame-Options "ALLOW-FROM %{X_FRAME_OPTIONS_ALLOWED}e" env=X_FRAME_OPTIONS_ALLOWED`

Treadway

With these settings, the client only receives one X-Frame-Options. The X-Frame-Options will be "SAMEORIGIN" or "ALLOW-FROM blog.example1.com". This works with Chrome and Firefox. Note: I hat to write always set instead of set and append to get it work. – Ectoderm

Answer 5

Since the support for ALLOW-FROM is varying in both implementation and support across browsers I tried the following solution which either sets SAMEORIGIN or conditionally removes X-Frame-Options altogether.

Tried on apache-2.4.

# Set X-Frame-Options SAMEORIGIN _unless_ the referer is any of my allowed sites.
# Add one or more SetEnvIf - whatever suits your purpose
# This part you MUST adapt.

# ALLOW https://my.allowed.site.com
SetEnvIf Referer "^https:\/\/my\.allowed\.site\.com\/.*" X_FRAME_OPTIONS_ALLOWED

# ALLOW https://mysite.tld.com and https://yoursite.tld.com
SetEnvIf Referer "^https:\/\/(mysite|yoursite)\.tld\.com\/.*" X_FRAME_OPTIONS_ALLOWED

# ALLOW https://mysite.tld.com and https://yoursite.theother.org
SetEnvIf Referer "^https:\/\/(mysite\.tld\.com|yoursite\.theother\.org)\/.*" X_FRAME_OPTIONS_ALLOWED

# Set X-Frame-Options = SAMEORIGIN _unless_ the referer is in the allow list.
Header always set X-Frame-Options SAMEORIGIN env=!X_FRAME_OPTIONS_ALLOWED

# Always _unset_ X-Frame-Options if the referer is in the allow list.
Header always unset X-Frame-Options env=X_FRAME_OPTIONS_ALLOWED

You could either add multiple SetEnvIf or expand the regex - YMMV.

Your colleagues will love your for making things readable...

Inadequate

Answer 6

EDIT 17/01/2018 :

This solution below is not correct, as the setting on each line is overwriting the previous one. so you only allow http://example.com/

Finaly i found the correct syntax for that. According to this site : https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Header set X-Frame-Options "ALLOW-FROM https://example.com/"

This worked for me :

Header always set X-Frame-Options "ALLOW-FROM https://www.example.com/"
Header always set X-Frame-Options "ALLOW-FROM https://example.com/"
Header always set X-Frame-Options "ALLOW-FROM http://www.example.com/"
Header always set X-Frame-Options "ALLOW-FROM http://example.com/"

Prather

any reason you didn't just delete this answer when you realized it doesn't work? – Polysyllable

Answer 7

The specification for X-Frame-Options only specifies to use one of DENY, SAMEORIGIN and ALLOW-FROM (https://www.rfc-editor.org/rfc/rfc7034#section-2.1). Some browsers may support multiple ALLOW-FROM, but many browsers don't support ALLOW-FROM at all.

Your best option is to implement the Content-Security-Policy header with the frame-ancestors directive. This allows multiple URIs to be configured and is understood by most browsers but IE and Edge 14 and below.

For IE and Edge 14 support you can also set the X-Frame-Options with ALLOW-FROM. If you create a whitelist of values you may be able to set the ALLOW-FROM URI based on the referrer.

It doesn't hurt to set both headers. Browsers that understand Content-Security-Policy frame-ancestors will ignore X-Frame-Options and those that don't understand frame-ancestors will ignore it and use X-Frame-Options if available. Combining https://caniuse.com/#search=csp and https://caniuse.com/#search=x-frame-options this will work for all browsers except "UC Browser for Android"

Henricks