如何防止我的网站页面通过 iFrame 的第 3 方网站框架加载

2021-12-21 00:00:00 python http-headers frame iframe php

如何在页面加载期间发现我的页面作为框架嵌入到其他站点?我猜推荐人请求标头在这里帮不了我?谢谢.

How can I find out that my page is embedded as a frame to other site during page loading? I guess referrer request header can't help me here? Thanks.

推荐答案

你不能从服务器端检查它，但你可以在页面加载后使用 javascript 来检测它.比较top和self，如果它们不相同，你就在一个框架中.

You cannot check it from the server's side, but you can use javascript to detect it after the page has loaded. Compare top and self, if they're not identical, you are in a frame.

此外，一些现代浏览器尊重 X-FRAME-OPTIONS 标头，它可以有两个值:

Additionally, some modern browsers respect the X-FRAME-OPTIONS header, that can have two values:

  • DENY - 如果页面包含在框架中，则防止页面被呈现
  • SAMEORIGIN – 与上述相同，除非页面与顶级框架集持有者属于同一域.

用户包括无法嵌入框架的 Google 的 Picasa.

Users include Google's Picasa, that cannot be embedded in a frame.

支持header的浏览器，最低版本:

Browsers that support the header, with the minimum version:

  • IE8 和 IE9
  • Opera 10.50
  • Safari 4
  • Chrome 4.1.249.1042
  • Firefox 3.6.9(带有 NoScript 的旧版本)
  • IE8 and IE9
  • Opera 10.50
  • Safari 4
  • Chrome 4.1.249.1042
  • Firefox 3.6.9 (older versions with NoScript)

相关文章