iframe嵌套其他网站提示连接被拒绝

报错信息：Refused to display 'http://xxxxxxx.xyz/' in a frame because it set 'X-Frame-Options' to 'deny'.

最近开发项目中遇到了客户iframe嵌套我们项目，遇到了域名提示...拒绝了您的访问。然后百度了一下
X-Frame-Options： HTTP 响应头是用来给浏览器指示允许一个页面可否在, </code>, <code><embed></code> 或者 <code><object></code> 中展现的标记。站点可以通过确保网站没有被嵌入到别人的站点里面，从而避免点击劫持攻击。<br> X-Frame-Options 有三个属性值：</p> <ol> <li>deny<br> 表示该页面不允许在frame中展示，即便是在相同域名的页面中嵌套也不允许。</li> <li>sameorigin<br> 表示该页面可以在相同域名页面的frame中展示。</li> <li>allow-from uri<br> 表示该页面可以在指定来源的frame中展示。</li> </ol> <h4 id="nginx配置">nginx配置</h4> <p>需要添加到 ‘http’, ‘server’ 或者 ‘location’ 的配置项中，个人来讲喜欢配置在‘server’ 中<br> 正常情况下都是使用SAMEORIGIN参数，允许同域嵌套<br> <code>add_header X-Frame-Options SAMEORIGIN;</code><br> 允许单个域名iframe嵌套<br> <code>add_header X-Frame-Options ALLOW-FROM http://whsir.com/;</code><br> 允许多个域名iframe嵌套，注意这里是用逗号分隔<br> <code>add_header X-Frame-Options "ALLOW-FROM http://whsir.com/,https://cacti.org.cn/";</code></p> <h4 id="nginx示例">nginx示例</h4> <pre><code> server { listen 80; server_name *.xxxxxxx.xyz; location /public/ { autoindex on; alias /usr/local/nginx/html/web/myblog/node/public/; } location /webgate/ { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://127.0.0.1:1314/api/; } location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # add_header X-Frame-Options deny; # 此处设置X-Frame-Options配置 add_header X-Frame-Options "ALLOW-FROM https://xxx2.xxxxxxx.com"; if ($host ~ ^(xxxx)\.xxxxxxx\.xyz$) { proxy_pass http://0.0.0.0:8083; } if ($host ~ ^(xxxx)\.xxxxxxx\.xyz$) { proxy_pass http://0.0.0.0:8081; } if ($host ~ ^(xxxx)\.xxxxxxx\.xyz$) { proxy_pass http://0.0.0.0:8082; } proxy_pass http://127.0.0.1:1314/; } } </code></pre> <p>如何确定已经修改生效：<br> </p> </div>  <div class="p-2"></div> <div class="arcinfo my-3 fs-7 text-center"> <a href='/t/etagid8885-0.html' class='tagbtn' target='_blank'>问题记录</a> </div> <div class="p-2"></div> </div> <div class="p-2"></div>  <div class="lbox p-4 shadow-sm rounded-3"> <div class="boxtitle"><h2 class="fs-4">相关</h2></div> <hr> <div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-517263.html">mysql问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-509388.html">使用linux过程中的问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-492173.html">Qt使用问题记录——Qt使用Qss</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-477228.html">问题记录_Postman请求记录存本地并设置中文</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-471962.html">pytorch转onnx再转ncnn过程及问题记录（主要包括pytorch转onnx：Relu6不支持，onnx转ncnn:Re</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-455724.html">flatbuffers 使用问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-439956.html">FPGA——vivado FIFO问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-433631.html">常见问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-431480.html">spring boot @Valid注解未生效问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-417591.html">鸿蒙hi3861V100开发板问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-410930.html">【问题记录】IIS配置项</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div><div class="row g-0 py-2 border-bottom align-items-center"> <div class="col-7 col-lg-11 border-lg-end"> <h3 class="fs-6 mb-0 mb-lg-2"><a href="/a/1-405962.html">简明 ASP.NET Core 手册问题记录</a></h3> <div class="ltag fs-8 d-none d-lg-block"> </div> </div> </div>   </div>  </div> <div class="col-lg-3 col-12 p-0 ps-lg-2">     <div class="lbox p-4 shadow-sm rounded-3"> <div class="boxtitle pb-2"><h2 class="fs-4"><a href="#">标签</a></h2></div> <div class="clearfix"></div> <ul class="m-0 p-0 fs-7 r-tag"> </ul> <div class="clearfix"></div> </div>  </div> </div> </div> </main> <div class="p-2"></div> <footer> <div class="container-fluid p-0 bg-black"> <div class="container p-0 fs-8"> <p class="text-center m-0 py-2 text-white-50">一品网 <a class="text-white-50" href="https://beian.miit.gov.cn/" target="_blank">冀ICP备14022925号-6</a></p> </div> </div> <script> var _hmt = _hmt || []; (function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?6e3dd49b5f14d985cc4c6bdb9248f52b"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s); })(); </script> </footer> <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.min.js"></script> </body> </html>