작성일 댓글 남기기

[서버] 우분투 기준 + frame because it set ‘X-Frame-Options’ to ‘sameorigin’ 발생

frame because it set 'X-Frame-Options' to 'sameorigin'.

총 3가지의 옵션이 있다.
1. DENY
 -> 추천하지 않음. 완전 폐쇄일 경우 설정.
2. SAMEORIGIN
 -> 기본 설정
3. ALLOW-FROM http://example.com/ 
 -> 예외처리라고 생각하면 됩니다.(자신의 도메인 사이트 주소를 입력)
[/etc/apache2/apache2.conf] 마지막줄에 추가
 Header set X-Frame-Options: "ALLOW_FROM http://siacoco.cco.kr"
 Header set Content-Security-Policy: "frame-ancestors http://siacoco.cco.kr"
 Header set X-Frame-Options: "ALLOW_FROM https://wordpress.org"
 Header set Content-Security-Policy: "frame-ancestors https://wordpress.org"
 Header always append X-Frame-Options SAMEORIGIN 

요건 참고
<IfModule headers_module>
 Header always append X-Frame-Options SAMEORIGIN 
</IfModule>
http://wony.kr/iframe-%EC%97%90-%ED%8E%98%EC%9D%B4%EC%A7%80%EA%B0%80-%EB%9C%A8%EC%A7%80-%EC%95%8A%EB%8A%94-%EA%B2%BD%EC%9A%B0-x-frame-options/

위의 글에서는 /etc/apache2/conf-available/security.conf 에서 수정하라고 하는데,
/etc/apache2/apache2.conf 파일에서 수정하도록 하자.

아래는 참고한 수두룩한 사이트들

https://slobell.com/blogs/29

http://allthatyou.kr/?p=637

https://codeday.me/ko/qa/20190318/49401.html

https://developer.mozilla.org/ko/docs/Web/HTTP/Headers/X-Frame-Options

https://www.google.com/search?q=ubuntu+Header+set+X-Frame-Options&oq=ubuntu+Header+set+X-Frame-Options+&aqs=chrome..69i57j33.7605j0j7&sourceid=chrome&ie=UTF-8

https://hosts.tistory.com/428

여러 참고 사이트 추가.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

https://developer.mozilla.org/ko/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

https://stackoverflow.com/questions/37799258/content-security-policy-directive-frame-ancestors-self

https://discourse.roots.io/t/content-security-headers-and-iframe/13320/2

https://github.com/roots/trellis/blob/e3315fef63f290757e5ab249c96c01dadb84a8c2/roles/nginx/templates/h5bp/directive-only/extra-security.conf

답글 남기기