Topic: [HOWTO] Allow SMF 2.0.x to run in an iframe

[vbgamer45]

In this simple guide we will show how to allow SMF 2.0.x to run in an iframe.

Open your index.php in the root directory of your forum

Find

Code: [Select]

header('X-Frame-Options: SAMEORIGIN');
Change to

Code: [Select]

// header('X-Frame-Options: SAMEORIGIN');


[live627]

Wouldn't this then open the door to clickjacking?

[Aleksi "Lex" Kilpinen]

There are risks, but there are also valid usecases.

[Kindred]

personally, I think that iframes are outdated at this point.... with the various SSI functions from pretty much every site, why would you open yourself to the potential security issues?

[Masterd]

Wouldn't this then open the door to clickjacking?

It most certainly would. Iframes are an outdated and risky concept at this point.

[spiros]

Even better, define extra sites with Content-Security-Policy: frame-ancestors

https://www.simplemachines.org/community/index.php?topic=566974.msg4015060#msg4015060

[vbgamer45]

Learned something new.

[spiros]

Well, we all live and learn, took me a couple of hours searching to sort it out...