How to set 'X-Frame-Options' on iframe?
You can't set X-Frame-Options
on the iframe
. That is a response header set by the domain from which you are requesting the resource (google.com.ua
in your example). They have set the header to SAMEORIGIN
in this case, which means that they have disallowed loading of the resource in an iframe
outside of their domain. For more information see The X-Frame-Options response header on MDN.
A quick inspection of the headers (shown here in Chrome developer tools) reveals the X-Frame-Options
value returned from the host.
X-Frame-Options
is a header included in the response to the request to state if the domain requested will allow itself to be displayed within a frame. It has nothing to do with javascript or HTML, and cannot be changed by the originator of the request.
This website has set this header to disallow it to be displayed in an iframe
. There is nothing that can be done in a client-side web browser to stop this behaviour.
Further reading on X-Frame-Options