[SOLVED] HTTP: open frame from specific domains

[Vieri]

Hi,

I have a PHP script on an Apache server. I want it to be loaded ONLY as a frame and only from specific domains.

I have this in the script:

[alamahant]

Hi
what you can do is add a "<Files></Files>" clause to your vhost config file in apache.
something like:

[Hu]

As I read the opening post, the request is that the script can be rendered in a frame served from allowed.example.org, but not rendered in a frame served from denied.example.org. As I read the Apache Access Control documentation, Require host is used to require that the request originate from the named host. These are different situations. OP wants to allow a browser running anywhere to request the document, but only if the browser is making the request as a result of a frame from allowed.example.org. Require host would be appropriate if you want to specify that only a browser running at client.example.org could make requests, but not browsers running on denied.example.org.

[Banana]

There you go:
https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#Defending_with_X-Frame-Options_Response_Headers
_________________
My personal space
My delta-labs.org snippets do expire

PFL - Portage file list - find which package a file or command belongs to.

[Vieri]

Very nice site, thank you.

Is it possible to block "direct" access to the frame script and allow it to render ONLY when accessed as an included iframe?
In other words, https://domain/frame.php would never show content whereas https:/domain/showframe.php would.

[EDIT] well, I guess that would fall into the "deny client connection" category to that specific script, but can it be done with just PHP (no apache)?

[Ant P.]

Make it check the Referer [sic] header contains one of those domains, which should be the case when it's in a frame.

On the sending side the iframe should have referrerpolicy="strict-origin" or "no-referrer-when-downgrade".

[Vieri]

Thanks!