Bypassing x-frame-options

What exactly is X-Frame-Options ?

From the official Mozilla Developer docs:

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> . Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.

Available directives for X-Frame-Options

• DENY: block everything in a frame
• SAMEORIGIN: block everything except if the web page is from the same origin
• ALLOW-FROM <uri> : allow frames just from the specified origin

How to bypass it ?

Well… you can’t fully bypass it. One alternative could be to create a remote server that requests a specified website for you and returns it without X-Frame-Options header.

Node.js and Express approach

In this article we will build a server based on the Express framework.

Prerequisites

• JavaScript promises
• Basic understanding of Node.js and Express

Dependencies