Django iframe加载被xframe选项拒绝，即使在视图设置为@xframe_options_exempt之后也是如此
Django iframe加载被xframe选项拒绝，即使在视图设置为@xframe_options_exempt之后也是如此
提问于 2018-08-23 01:01:51
我有一个django应用程序，我想在任何网站上嵌入一个embed视图作为iframe。我认为我已经正确配置了这个，因为我将视图设置为@xframe_options_exempt，但在Chrome和Firefox中我仍然得到一个x-frame选项错误。
Chrome：Refused to display 'https://foo.com/embed/...' in a frame because it set 'X-Frame-Options' to 'deny'.
火狐：Load denied by X-Frame-Options: 'https://foo.com/embed/...' does not allow framing
views.py
from django.shortcuts import render, get_object_or_404, redirect
from django.views.decorators.clickjacking import xframe_options_exempt
@xframe_options_exempt
def embed(request, bar_slug, slug):
embed_object = get_object_or_404(foo, slug=slug)
if embed_object.bar.slug != bar_slug:
raise Http404
embed_url = '{}{}'.format('https://foo.com/embed', embed_object.get_absolute_url())
context = {
'embed_object': embed_object,
'embed_url': embed_url,
'embed_url_encode': urlquote_plus(embed_url),
}
return render(request, 'causes/embed.html', context)settings.py
MIDDLEWARE_CLASSES = [
'djangosecure.middleware.SecurityMiddleware',
'project.utils.middleware.SiteMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'corsheaders.middleware.CorsMiddleware',
'project.utils.middleware.HoneypotMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
]我假设djangosecure.middleware.SecurityMiddleware在@xframe_options_exempt上强制执行“X帧选项”。我更喜欢用特定于视图的解决方案来解决这个问题，而不是设置X_FRAME_OPTIONS = 'ALLOW'。谢谢
回答 1
Stack Overflow用户
发布于 2018-08-23 01:19:25
我为embed视图使用了两个装饰器，使其正常工作：
from djangosecure.decorators import frame_deny_exempt
from django.views.decorators.clickjacking import xframe_options_exempt
@xframe_options_exempt
@frame_deny_exempt
def embed(...)我错过了django的安全装饰器。
https://django-secure.readthedocs.io/en/v0.1.1/middleware.html
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/51971840
复制相关文章
相似问题
腾讯云开发者
