3C健忘人 - 疑難排除不求人 - no more ask for IT help

在 .htaccess 檔案內 <meta>標籤內設定不被iframe嵌入 Header set X-Frame- Options DENY 僅允許同樣來源主機 Header append X-FRAME-OPTIONS " SAMEORIGIN " 可允許某些特定主機 Header append X-FRAME-OPTIONS ALLOW-FROM https://facebook.com/ reference https://gist.github.com/jgarciaruiz/68c53352efb028cf4cc0cf8873b3b216

#Apache 設定 Header always append X-Frame-Options SAMEORIGIN #HTML META <meta http-equiv="X-Frame-Options" content="deny">   <meta http-equiv="X-Frame-Options" content="SAMEORIGIN"> <meta http-equiv="X-Frame-Options" content="ALLOW-FROM https://myhost"> #Nginx 設定 location /{ add_header X-Frame-Options SAMEORIGIN }   #IIS <system.webServer> ... < httpProtocol > < customHeaders > < add name = " X-Frame-Options " value = " SAMEORIGIN " /> </ customHeaders > </ httpProtocol > ... </system.webServer>     #HAProxy rspadd X-Frame-Options:\ SAMEORIGIN   #PHP 方式 header('X-Frame-Options:Deny'); header('X-Frame-Options:SAMEORIGIN'); header('X-Frame-Options:ALLOW-FROM https://myhost ')     if($_server['http_host']!='localhost'){exit('iframe is spammed');} ...