Php photo gallery TWG | JFUploader | TWG Flash upload | WFU | Forum

Good morning... I am having an issue with the plugin not displaying the content in Chrome and Firefox though it does work properly in IE. The iframe is supposed to display right below the slider on the home page and the content page is located at http://osd.yourwestend.com/WebSiteNotices.aspx. I have tried checking the page at http://www.tinywebgallery.com/blog/advanced-iframe/free-iframe-checker but it just seems to timeout before returning any information. I do have full control over the http://osd.yourwestend.com site and have the applicable script references in the page (<script src="http://yourwestend.com/wp-content/plugins/advanced-iframe/js/ai_external.js"></script>) The web site that the iframe is supposed to appear in is http://yourwestend.com/. Please let me know if there is any additional information that I could provide to help troubleshoot.

Thanks,
Greg

I cannot reach http://osd.yourwestend.com/WebSiteNotices.asp -> ERR_CONNECTION_RESET

Is there a temp problem?

Best, Michael

Hi Michael... Thanks for the quick reply. Just missing the "x" at the end of the URL... http://osd.yourwestend.com/WebSiteNotices.aspx.

Thanks,
Greg

Same for
http://osd.yourwestend.com/WebSiteNotices.aspx

Best, Michael

Well that's odd... it comes up fine on all 3 browsers and my phone... likely a dumb question but am I safe to assume that you're just using a browser to access it? I've attached a screen shot of how it displays here if I navigate to it in a browser. I'm also attaching a trace route in hopes that it will give some insight into the issue. Is there anything else I can send you to help?

Thanks,
Greg

Seems from Germany a tracert stops at step 14.
I tried with several Internet connections.
14 97 ms 97 ms 97 ms windstream-ic-302424-ash-b1.c.telia.net [213.248.99.230]
Is the last one ...

Have you checked the Javascript console in Chrome? Press F12. Do you get any messages there?

Beest, Michael

Thanks Michael... I'd forgotten that the server that this site is hosted on is set up to only allow Canadian traffic which would be the issue with you bringing up the page. I'd not considered their could be a script issue in Chrome or Firefox... unfortunately I'm not familiar with Javascript so far so haven't used this area of the browsers Looks like you're onto something... in Chrome this is the error message that is displayed:

Refused to display 'http://yourwestend.com/wp-content/plugins/advanced-iframe/js/iframe_height.html?height=182&width=939&id=advanced_iframe' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

In Firefox:

Load denied by X-Frame-Options: http://yourwestend.com/wp-content/plugins/advanced-iframe/js/iframe_height.html?height=182&width=939&id=advanced_iframe does not permit cross-origin framing.


I'm not sure about the X-Frame options as I hadn't set them but looks like it defaults to "SAME ORIGIN". I did a little reading on the options and played around with it on the server but looks like the only options that I can set are "SAME ORIGIN" or "DENY" which doesn't seem to make sense to me. I suspect I am missing something obvious but can't seem to find a way to allow the page to be displayed in the plugin. Please let me know if there is any other info I can provide to help.

Thanks,
Greg

Does the page in the iframe display if you don't include the ai_external.js script?

Because iframe_height.html is actually only the callback. Also you can switch to postMessage Communication on the "external workaround" tab. Then not iframe_height.html is used but an internal way.

But if you have full control about the pages you should be able to remove the X-Frame-Options header. This is maybe set by your server. If you have an apache you can set this in security.conf.

Best, Michael

Thanks Michael... My answers are below.

Does the page in the iframe display if you don't include the ai_external.js script?
** Unfortunately not...

Because iframe_height.html is actually only the callback. Also you can switch to postMessage Communication on the "external workaround" tab. Then not iframe_height.html is used but an internal way.
** I'll have to take a closer look at this option.

But if you have full control about the pages you should be able to remove the X-Frame-Options header. This is maybe set by your server. If you have an apache you can set this in security.conf.
** The site is hosted on an IIS server and so far I've found nothing that I can change to allow for an iframe in another web site. Looks like some of the settings used to work but are no longer respected by Chrome or Firefox. I'll definitely have to get back to this problem as soon as I can...

I think simply Firefox and Chrome stick to the standard for the header. While IE is somehow ignoring it.

The header can also be set by the server side application. Do you have control of this?

Best, Michael

Hi Michael... Thanks for sticking with this. I think you're correct on Firefox and Chrome being overly concerned though that could just be my ignorance showing . I do have full control over the web server (IIS) that is hosting the page I'm trying to insert into the iFrame but haven't had any luck getting it to work. I've found some references to the allowable settings (i.e.: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) though the only one that would work in my case is (X-Frame-Options: ALLOW-FROM https://example.com/) which apparently isn't recognized any more. Adding back in the (<script src="http://yourwestend.com/wp-content/plugins/advanced-iframe/js/ai_external.js"></script>) to the iframe page and adding in the setting on the server results in these errors:

Chrome: (index):1 Invalid 'X-Frame-Options' header encountered when loading 'http://osd.yourwestend.com/websitenotices.aspx': 'ALLOW-FROM http://osd.yourwestend.com' is not a recognized directive. The header will be ignored.
websitenotices.aspx:1 Refused to display 'http://yourwestend.com/wp-content/plugins/advanced-iframe/js/iframe_height.html?height=172&width=724&id=advanced_iframe' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Firefox: Load denied by X-Frame-Options: http://osd.yourwestend.com/ does not permit framing by http://yourwestend.com/.

Thanks,
Greg

you have to remove the header completely.
It is either set by your application or by your server.

Best, Michael

Thanks Michael... I'll take another look