Detect X-Frame-Options

iframe, javascript

Solution

Because your script and the target URL are on different domains, JavaScript's cross domain policy won't let you access the headers. I ran into the same problem a few months ago and ended up using JavaScript to send an AJAX request to a PHP file which could then parse the headers.

This is what I had in the PHP file. This would then return the result in a JSON array. Let me know if it helps!

$error=false;
$urlhere='http://facebook.com';
$ch = curl_init();

$options = array(
        CURLOPT_URL            => $urlhere,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HEADER         => true,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_ENCODING       => "",
        CURLOPT_AUTOREFERER    => true,
        CURLOPT_CONNECTTIMEOUT => 120,
        CURLOPT_TIMEOUT        => 120,
        CURLOPT_MAXREDIRS      => 10,
);
curl_setopt_array($ch, $options);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch);
$headers=substr($response, 0, $httpCode['header_size']);
if(strpos($headers, 'X-Frame-Options: deny')>-1||strpos($headers, 'X-Frame-Options: SAMEORIGIN')>-1) {
        $error=true;
}
$httpcode= curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo json_encode(array('httpcode'=>$httpcode, 'error'=>$error));

I know it's not an ideal response but it's all I could get to work with my project.

Edit: As Bill stated below, if you change `strpos()` to `stripos()` you might get better results as it runs a case insensitive search instead.

Problem

Is there a way to detect whether or not a page is allowed to load within an iframe? If a URL can not load within an iframe, I would like to let the user know that the URL they are submitting will not work on our site. I have tried to get the contents, but that doesn't work: ``` $("iframe#data-url").on("load", function() { alert($(this).contents()) }); ``` I am not really sure where to go from here. Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'DENY'. Is there a way to detect `X-Frame-Options`?

Original source