blocks|key|693933|text|嗯，我想你不能。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|693934|iframe是一个客户端容器，这意味着最终用户浏览器负责加载iframe中的内容。您无法区分页面是否加载到iframe中。|693935|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Umm, I don't think you can.

An iframe is a client side container, which means that the end users browser is responsible for loading the content within the iframe. You wouldn't be able to tell the difference between whether your page was loaded in an iframe or not.

blocks|key|693999|text|我不认为你可以通过.htaccess，但是你可以使用JS。您可以使用类似下面的函数来检查：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|694000|function+parentIsSameOrigin()
{
++++var+result+=+true;
++++if+(window.parent)
++++{
++++++++result+=+Boolean
++++++++(
++++++++++++//+more+precise+modifications+needed+here
++++++++++++window.this.location.href.indexOf(window.parent.location.href)+==+0
++++++++);
++++}
++++return+result;
}|code-block|syntax|javascript|694001|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I don't think you can through .htaccess, you can use JS however. You can use a function like this one to check:

<pre><code>function parentIsSameOrigin()
{
 var result = true;
 if (window.parent)
 {
 result = Boolean
 (
 // more precise modifications needed here
 window.this.location.href.indexOf(window.parent.location.href) == 0
 );
 }
 return result;
}
</code></pre>

blocks|key|694042|text|您可以使用.htaccess，如下所示|type|unstyled|depth|inlineStyleRanges|entityRanges|data|694043|RewriteEngine+On

RewriteCond+%25{QUERY_STRING}+!%5Eid=[%5E&]%2B+[NC]
#+if+referrer+is+bad.com
RewriteCond+%25{HTTP_REFERER}+(www\.)?bad\.com+[NC]
#+then+redirect+to+a+different+page
RewriteRule+!%5E404.shtm+[L,NC,R=302]|code-block|syntax|javascript|694044|为此，您需要依赖HTTP_REFERER。此代码将把来自bad.com的所有请求重定向到not+found页面|694045|这个解决方案促成了这个答案。|694046|https://stackoverflow.com/a/19773719/1641233|offset|length|694047|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|0|0|18|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|W|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|X|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|Y|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|Z|8|@]|9|@$M|10|N|11|1|12]]|A|$]]|$1|O|3|-4|5|6|7|13|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|L]]]]

you can use .htaccess as the following

<pre><code>RewriteEngine On

RewriteCond %{QUERY_STRING} !^id=[^&amp;]+ [NC]
# if referrer is bad.com
RewriteCond %{HTTP_REFERER} (www\.)?bad\.com [NC]
# then redirect to a different page
RewriteRule !^404.shtm [L,NC,R=302]
</code></pre>

You will need to rely on HTTP_REFERER for this this code will redirect any requests from the bad.com to the not found page

this solution contributed to this answer

<a href="https://stackoverflow.com/a/19773719/1641233">https://stackoverflow.com/a/19773719/1641233</a>

blocks|key|694085|text|你不能每次都“强制执行”它，因为有其他的方法，但是你可以使用标准的头方法。html5-boilerplate有一个很好的vhost/htaccess代码片段，它首先将X-Frame-Options设置为您选择的DENY/SAMEORIGIN/ALLOW-FROM，然后允许在好的框架中使用白名单MIME类型，比如谷歌图像搜索。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|694086|查看最新链接，但这里是2016年1月25日在SAMEORIGIN模式下的示例：|694087|<IfModule+mod_headers.c>

+++++Header+set+X-Frame-Options+"SAMEORIGIN"

+++++<FilesMatch+"\.(appcache%7Catom%7Cbbaw%7Cbmp%7Ccrx%7Ccss%7Ccur%7Ceot%7Cf4[abpv]%7Cflv%7Cgeojson%7Cgif%7Chtc%7Cico%7Cjpe?g%7Cjs%7Cjson(ld)?%7Cm4[av]%7Cmanifest%7Cmap%7Cmp4%7Coex%7Cog[agv]%7Copus%7Cotf%7Cpdf%7Cpng%7Crdf%7Crss%7Csafariextz%7Csvgz?%7Cswf%7Ctopojson%7Ctt[cf]%7Ctxt%7Cvcard%7Cvcf%7Cvtt%7Cwebapp%7Cweb[mp]%7Cwebmanifest%7Cwoff2?%7Cxloc%7Cxml%7Cxpi)$">
+++++++++Header+unset+X-Frame-Options
+++++</FilesMatch>

</IfModule>|code-block|syntax|javascript|694088|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/h5bp/html5-boilerplate/blob/master/dist/.htaccess#L405^0|2B|F|2X|Q|11|H|0|0|M|A|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]|$9|X|A|Y|B|C]]|D|@$9|Z|A|10|1|11]]|E|$]]|$1|F|3|G|5|6|7|12|8|@$9|13|A|14|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|15|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|16|8|@]|D|@]|E|$]]]|N|$O|$5|P|Q|R|E|$S|T]]]]

You can't "enforce" it per-say since there are ways around, but you can use the standard header method. <a href="https://github.com/h5bp/html5-boilerplate/blob/master/dist/.htaccess#L405" rel="nofollow">html5-boilerplate</a> has a nice vhost/htaccess snippet that first sets <code>X-Frame-Options</code> as your choice of <code>DENY/SAMEORIGIN/ALLOW-FROM</code>, and then allows whitelist MIME types for use in good frames such as Google image search.

Check the link for latest, but here is the example from Jan 25 2016 in <code>SAMEORIGIN</code> mode:

<pre><code>&lt;IfModule mod_headers.c&gt;

 Header set X-Frame-Options "SAMEORIGIN"

 &lt;FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|webmanifest|woff2?|xloc|xml|xpi)$"&gt;
 Header unset X-Frame-Options
 &lt;/FilesMatch&gt;

&lt;/IfModule&gt;
</code></pre>

Recently my complete site is called in iframe by two other domains. I would like to block other sites, who are trying to show my site in iframe.

How can i block that through .htaccess?

How to Block Iframe call

图像搜索

容器

最近，我的整个站点在iframe中被另外两个域调用。我想阻止其他网站，谁是试图显示我的网站在iframe。我如何通过.htaccess阻止它？

问如何阻止Iframe调用
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何阻止Iframe调用EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何阻止Iframe调用
EN