blocks|key|101063|text|这与Rails4在默认情况下启用额外的安全协议有关：http://weblog.rubyonrails.org/2013/2/25/Rails-4-0-beta1/|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|101064|在远程站点中断iFrames的设置是X-Frame-Options。默认设置为SAMEORIGIN，防止内容跨域加载：|101065|config.action_dispatch.default_headers+=+{
++++'X-Frame-Options'+=>+'SAMEORIGIN'
}|code-block|syntax|javascript|101066|您可以在此处阅读有关新的默认标头的信息：http://edgeguides.rubyonrails.org/security.html#default-headers|101067|为了允许iFrame跨域工作，您可以更改默认标头以允许跨域X-Frame。|101068|config.action_dispatch.default_headers+=+{
++++'X-Frame-Options'+=>+'ALLOWALL'
}|101069|entityMap|0|LINK|mutability|MUTABLE|url|http://weblog.rubyonrails.org/2013/2/25/Rails-4-0-beta1/|1|http://edgeguides.rubyonrails.org/security.html#default-headers^0|Q|1K|0|0|0|0|K|1R|1|0|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|D|3|E|5|6|7|14|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|15|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|16|8|@]|9|@$A|17|B|18|1|19]]|C|$]]|$1|M|3|N|5|6|7|1A|8|@]|9|@]|C|$]]|$1|O|3|P|5|H|7|1B|8|@]|9|@]|C|$I|J]]|$1|Q|3|-4|5|6|7|1C|8|@]|9|@]|C|$]]]|R|$S|$5|T|U|V|C|$W|X]]|Y|$5|T|U|V|C|$W|Z]]]]

<p>This has to do with Rails 4 enabling additional security protocols by default: <a href="http://weblog.rubyonrails.org/2013/2/25/Rails-4-0-beta1/">http://weblog.rubyonrails.org/2013/2/25/Rails-4-0-beta1/</a></p>

<p>The setting that breaks iFrames on remote sites is X-Frame-Options. By default, this is set to SAMEORIGIN, which prevents the content from being loading cross domain:</p>

<pre><code>config.action_dispatch.default_headers = {
    'X-Frame-Options' =&gt; 'SAMEORIGIN'
}
</code></pre>

<p>You can read about the new default headers here:
<a href="http://edgeguides.rubyonrails.org/security.html#default-headers">http://edgeguides.rubyonrails.org/security.html#default-headers</a></p>

<p>In order to allow the iFrame to work cross domain, you can change the default headers to allow X-Frame across domain.</p>

<pre><code>config.action_dispatch.default_headers = {
    'X-Frame-Options' =&gt; 'ALLOWALL'
}
</code></pre>


blocks|key|318177|text|我正在使用Rails+6和Chromium+76。以前的X-Frame-Options解决方案不起作用。但我注意到，当我们将在线iframe与JS连接时，它工作得很好。所以，在我看来，我只是做了一个简单的解决方案：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|318178|<div+id='iframe_wrapper'+'data-iframe-content'='<iframe+src="https://host.com/"></iframe>'>
</div>|code-block|syntax|javascript|318179|...and添加如下JS代码：|318180|$(document).ready(function()+{
++var+wrapper+=+$('#iframe_wrapper')[0]
++wrapper.innerHTML+=+wrapper.attributes['data-iframe-content'].value
})|318181|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

<p>I'm working with Rails 6 and Chromium 76. Previous solution with X-Frame-Options is not working. But I've noticed that it works very well when we attach online iframe with JS. So, I just made this simple solution in my view:</p>

<pre class="lang-html prettyprint-override"><code>&lt;div id='iframe_wrapper' 'data-iframe-content'='&lt;iframe src="https://host.com/"&gt;&lt;/iframe&gt;'&gt;
&lt;/div&gt;
</code></pre>

<p>...and add JS code like this:</p>

<pre><code>$(document).ready(function() {
  var wrapper = $('#iframe_wrapper')[0]
  wrapper.innerHTML = wrapper.attributes['data-iframe-content'].value
})
</code></pre>


blocks|key|101115|text|更新:似乎ALLOW-FROM和ALLOWALL目前都是无效的"X-Frame-Options“标头值。唯一有效的两个是DENY和SAMEORIGIN，它们都不允许从另一个源访问。请参阅MDN文档：https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|101116|因此，看起来response.headers.delete+"X-Frame-Options"是现在唯一能够在另一个网站上显示iframe内容的方法。但如果有人知道我所不知道的，我很乐意证明这一点。|style|CODE|101117|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options^0|2R|21|0|0|6|15|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@$A|U|B|V|F|G]]|9|@]|C|$]]|$1|H|3|-4|5|6|7|W|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

<p>Update: seems like ALLOW-FROM and ALLOWALL are currently both invalid &quot;X-Frame-Options&quot; header values. The only two valid ones are DENY and SAMEORIGIN and neither allows access from another origin. See MDN documentation: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options</a>.</p>
<p>So looks like <code>response.headers.delete &quot;X-Frame-Options&quot;</code> is the only way now to enable displaying content in an iframe on another site. But I'd love to be proven otherwise if anyone has any knowledge I don't.</p>


<p>How can I embed my rails app into another website via iframe?</p>

<p>It works nicely with RoR 3, but not with RoR 4:</p>

<pre><code>&lt;iframe src="http://myrailsapp.com/" width="100%" height="50" id="rails_iframe"&gt;error!&lt;/iframe&gt;
</code></pre>

<p>I tried to use <code>verify_authenticity_token</code> and <code>protect_from_forgery</code> options in my controller... seems it's something else (but I'm not sure).</p>

<p>upd. Example:
<a href="http://jsfiddle.net/zP329/" rel="noreferrer">http://jsfiddle.net/zP329/</a></p>


Ruby on rails 4 app does not work in iframe

我如何通过iframe将我的rails应用程序嵌入到另一个网站？它在RoR 3上运行得很好，但在RoR 4上就不行：<iframe src="http://myrailsapp.com/" width="100%" height="50" id="rails_iframe">error!</iframe>我尝试在我的控...

问Ruby on rails 4应用程序在iframe中不起作用
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Ruby on rails 4应用程序在iframe中不起作用EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Ruby on rails 4应用程序在iframe中不起作用
EN