1. In the compatibility mode of the 360 Browser, the prompt “This content cannot be displayed in a frame” appears, as shown in Figure 1.
This content cannot be displayed in a frame
To help protect the security of information entered on this website, the publisher of this content does not allow it to be displayed in a frame.
2. Viewing the web page source code, I determined that this was caused by an iframe and inconsistent URLs, as shown in Figure 2.
3. Further analysis revealed that the root cause was the inclusion of X-Frame-Options: SAMEORIGIN in the response headers, as shown in Figure 3.
4. Locally, I created a new virtual host, tv.eastobacco.dev, and created a corresponding page, header.html, as shown in Figure 4.
5. I set the response header for tv.eastobacco.dev to X-Frame-Options: SAMEORIGIN, as shown in Figure 5.
6. Locally, I created a new virtual host, mytv.eastobacco.dev, and created a corresponding page, index.html, as shown in Figure 6.
7. I reproduced the issue locally: “This content cannot be displayed in a frame”, as shown in Figure 7.
8. On tv.eastobacco.dev, I created a corresponding page, index.html, which includes header.html from the same domain, as shown in Figure 8.
9. The prompt “This content cannot be displayed in a frame” no longer appears, as shown in Figure 9.
10. Therefore, it can be determined that the primary function of the response header X-Frame-Options: SAMEORIGIN is to allow header.html to be displayed only under the tv domain. However, the current requirement is to allow it to be displayed under all second-level domains. I set the response header to X-Frame-Options: frame-ancestors http://mytv.eastobacco.dev, as shown in Figure 10.
# add_header X-Frame-Options SAMEORIGIN;
add_header X-Frame-Options “Allow-From http://mytv.eastobacco.dev”;
add_header X-Frame-Options “Allow-From http://tv.eastobacco.dev”;
11. Repeating step 7, I found that header.html can be displayed under the mytv domain, as shown in Figure 11.
12. Repeating step 9, I found that header.html cannot be displayed under the tv domain, which does not meet expectations, as shown in Figure 12.
13. I reset the response header to X-Frame-Options: frame-ancestors http://*.eastobacco.dev, as shown in Figure 13.
add_header X-Frame-Options “Allow-From http://*.eastobacco.dev”;
14. Repeating step 7, I found that header.html cannot be displayed under the mytv domain, as shown in Figure 14.
15. I reset the response header to X-Frame-Options: frame-ancestors http://mytv.eastobacco.dev, http://tv.eastobacco.dev, as shown in Figure 15.
add_header X-Frame-Options “Allow-From http://mytv.eastobacco.dev, http://tv.eastobacco.dev”;
16. Repeating step 7, I found that header.html cannot be displayed under the mytv domain, as shown in Figure 16.
17. I reset the response header to X-Frame-Options: frame-ancestors http://mytv.eastobacco.dev; http://tv.eastobacco.dev, as shown in Figure 17.
add_header X-Frame-Options “Allow-From http://mytv.eastobacco.dev; http://tv.eastobacco.dev”;
18. Repeating step 7, I found that header.html cannot be displayed under the mytv domain, as shown in Figure 18.
19. Referring to the URL: https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/ , Allow-From does not support wildcards or a list of multiple sources, as shown in Figure 19.
20. Referring to the URL: https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Content-Security-Policy__by_cnvoid , I reset the response header to Content-Security-Policy: frame-ancestors http://*.eastobacco.dev, as shown in Figure 20.
add_header Content-Security-Policy “frame-ancestors http://*.eastobacco.dev”;
21. Repeating step 7, I found that header.html can be displayed under the mytv domain, which meets expectations, as shown in Figure 21.
22. Repeating step 9, I found that header.html can be displayed under the tv domain, which meets expectations, as shown in Figure 22.
23. Including header.html from tv under another top-level domain still succeeds, which does not meet expectations. Because compatibility mode does not support Content-Security-Policy, I decided to abandon the display restriction in compatibility mode and allow all domains to include header.html from tv, as shown in Figure 23.
24. Enabling speed mode and repeating step 7, I found that header.html can be displayed under the mytv domain, which meets expectations, as shown in Figure 24.
25. Enabling speed mode and repeating step 9, I found that header.html can be displayed under the tv domain, which meets expectations, as shown in Figure 25.
26. Including header.html from tv under another top-level domain, I found that header.html cannot be displayed, which meets expectations, as shown in Figure 26.
27. Repeating step 1, it displays normally, which meets expectations, as shown in Figure 27.
28. Compatibility mode is essentially the IE browser, and speed mode is essentially the Chrome browser. By setting only the Content-Security-Policy response header, security settings are forfeited in the IE browser. This ensures that across all browsers, http://*.eastobacco.dev can include header.html from tv, while other top-level domains cannot.