Bypassing x-frame-options
What exactly is X-Frame-Options ?
From the official Mozilla Developer docs:
The
X-Frame-Options
HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a<frame>
,<iframe>
or<object>
. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
Available directives for X-Frame-Options
- DENY: block everything in a frame
- SAMEORIGIN: block everything except if the web page is from the same origin
- ALLOW-FROM <uri> : allow frames just from the specified origin
How to bypass it ?
Well… you can’t fully bypass it. One alternative could be to create a remote server that requests a specified website for you and returns it without X-Frame-Options header.
Node.js and Express approach
In this article we will build a server based on the Express framework.
Prerequisites
- JavaScript promises
- Basic understanding of Node.js and Express