SharePoint: Rendering inside iframes


This post is a revision of an old blog post on rendering Excel Services in an iframe on a different domain. This is prohibited because a HTTP response header X-FRAME-OPTIONS: SAMEORIGIN is added to the response. The issue isn’t limited to Excel Services but is applicable to any SharePoint-hosted page that you want to visualize in an iframe.

Consider the following:

  • SharePoint 2013 will always render the X-FRAME-OPTIONS header, even for regular pages. Adding an AllowFraming control to the page fixes that, but doesn’t cover all situations
  • You can’t add the AllowFraming control to Office Web Apps or InfoPath Forms Server (“FormServer.aspx”)
  • Clicking on (pdf) documents in a Document Library in the iframe will fail to load them because the document is a different request
  • You have a basic “integration” between different systems (like Dynamics CRM) and SharePoint content that uses iframes

This content cannot be displayed in a frame

PermissiveXFrameHeader

This is a HttpModule that can be activated per Web Application by Web Application Feature and will ensure that all pages will render inside an iframe. The module will set values that will prevent SharePoint from trying to inject the header in the first place, but for some exceptions (Office Web Apps 2010, XLViewer 2013) it is still required to actually remove the header at the end of the request.

Please visit the Codeplex Repository to read more about this addon and for installation instructions: https://ventigrate.codeplex.com/wikipage?title=Permissive%20XFrame%20Header

 


Links to this post

Comments

Wednesday, 4 Jan 2012 10:19 by Frederik
Thanks Steven, this works great!!!

Thursday, 5 Jan 2012 11:22 by Eoan
This is very useful and works beautifully. Thank you.

Wednesday, 17 Jul 2013 03:19 by Doru Dan
Clever solution, thank you very much!

Monday, 4 Nov 2013 11:42 by Andy
Hi Steve it is possible to integrate office web app ( for .doc or .xls) using iframe in calculated columns (SharePoint 2013) ? for example like this with pdf addon http://sharepoint2020.wordpress.com/2012/08/10/create-pdf-thumbnail-view-in-column-using-iframes/ my Code works with the Content Editor but not in calculated columns Thanks Andy

Monday, 4 Nov 2013 03:56 by Steven Van de Craen
Hi Andy, you might have better luck with a Computed Field, but there's no UI to create one (only through code/script). Alternatively, you might be able to use my Advanced Computed Field which should allow you to do what you want. Read about it here: http://www.sharepointblogs.be/blogs/vandest/archive/2011/05/26/acf-2010-announcing-the-advanced-computed-field-for-sharepoint-2010.aspx

Thursday, 19 Jun 2014 05:25 by ronald
thanks man your a genius

Tuesday, 28 Oct 2014 07:22 by GT
Hi Steven, This works well for SharePoint 2013 pages but not for displaying InfoPath Forms on FormServer.aspx page. Any suggestion??

Friday, 31 Oct 2014 03:51 by Steven Van de Craen
Hi GT, I've looked into this for you and IPFS uses a different approach to enforce the response header. I've updated the solution so that it works for everything. Check it out on CodePlex :)

Thursday, 6 Nov 2014 01:05 by Reema Ferreira
Hi Steven, I tried out your solution but it still gives me the error. I have an IFRAME tag in a CEWP on SP2010 and I have given the src as a SharePoint hosted word document located in a different document library but it still gives me the error and asks me to open in a new window by clicking the link. Any suggestions? Do let me know. I have followed the steps outlined here: http://ventigrate.codeplex.com/wikipage?title=Permissive%20XFrame%20Header Many thanks - Reema P.S: I don't frequently look at this site, so would be thankful if you could email me at reema.pereira@catalystpaper.com

Wednesday, 12 Nov 2014 09:09 by Marko
Hi Steven, thanks for the tip. I managed to install the feature and in my special case the PowerView-Library is now shown in my iframe. But even though the PowerPivot-Library is shown now, as soon as I click on an Excel-File in thatLibrary and the XLViewer starts up I still get the same "X-Frame-Option SameOrigin" Message from the "xlviewer.aspx"-page. Did I miss something or do you have any other advice that would help me fix the problem? Thanks in advance! Marko

Friday, 14 Nov 2014 11:14 by Steven Van de Craen
Hi Reema, unfortunately Office Web Apps 2010 unconditionally adds the header anyway, so I've updated the solution to remove the header at the end of the request. Please download and update the farm solution.

Friday, 14 Nov 2014 11:14 by Steven Van de Craen
Hi Marko, unfortunately XLViewer 2013 unconditionally adds the header anyway, so I've updated the solution to remove the header at the end of the request. Please download and update the farm solution.

Thursday, 23 Apr 2015 07:01 by Aldy
Hi Steven, I've activated the PermissiveXFrameHeader, and tested it using standard html page with iframe in it, and it works great! My site is perfectly shown inside the iframe. But, if I click the Quick Launch menus, nothing happens. Also Item Links menus are not working too (the ellipsis button for each item in list). Do you have any advice to solve this problem? Many thanks for your great effort, I really appreciated it.

Sunday, 26 Apr 2015 10:51 by Steven Van de Craen
Hi Aldy, I think you're running into the same issue as described here: http://ventigrate.codeplex.com/discussions/586870. Unfortunately there isn't an easy solution as it is client side protection preventing this.

Tuesday, 6 Oct 2015 01:58 by Karim
Hi Steven Does this work with HTTPS? Thanks

Thursday, 8 Oct 2015 11:08 by Steven Van de Craen
Hi Karim, I don't see why it shouldn't. The header is manipulated on the server and the client sees the response decoded. What issues are you seeing? Are you mixing http with https?

Monday, 9 Nov 2015 04:34 by Christophe Verdin
Hi Steven, even if you stated it doesn't work, I've tried your patch with Sharepoint/OWA 2010 : it removes the header for both Word and XLS viewers but not for PPT viewer. I am surprised with this lack of consistence between viewers. Would you have any idea how to proceed apart setting-up a proxy?

Thursday, 12 Nov 2015 01:59 by Steven Van de Craen
Hi Christophe, It should work with OWA 2010 but for that I initially used a different approach. But the latest version available on CodePlex just does a blanket replace of the header which should overrule everything. Could you see if you have more luck with the latest version?

Tuesday, 15 Dec 2015 08:44 by Laith
Unfortunately i am trying to use your solution for OWA webparts (My Calendar,My Inbox ...etc), but nothing happen same issue appear i get message "This content cannot be displayed in a frame", i used it for my site web application on SharePoint 2013 environment.

Wednesday, 16 Dec 2015 01:02 by Steven Van de Craen
Hi Laith, the OWA webparts are actually themselves iframes for your webmail. In this case it is the webmail that doesn't allow to be rendered in an iframe. My solution will allow SharePoint to be rendered inside the iframe. Hope this helps.

Saturday, 23 Jan 2016 05:05 by PZ
Hi, Steven, We deployed this solution for rendering SharePoint page inside iframe. Now we are finding that SharePoint app (provider host app) is not working. Even after I deactivated the feature on Web App, I still got the same error: Application error when access /_layouts/15/appredirect.aspx, Error=Item has already been added. Key in dictionary: 'AllowFraming' Key being added: 'AllowFraming' at System.Collections.Hashtable.Insert(Object key, Object nvalue, Boolean add) at Microsoft.SharePoint.ApplicationPages.AppRedirectPage.HandleRequest() at Microsoft.SharePoint.ApplicationPages.AppRedirectPage.OnLoad(EventArgs e) at System.Web.UI.Control.LoadRecursive() at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) I am not sure AllowFraming is added by PermissiveXFrameHeader solution or not though. If I undeploy PermissiveXFrameHeader solution, I would get assembly loading error for related PermissiveXFrameHeader DLLs. Could you shed some lights here? Thanks very much.

Monday, 25 Jan 2016 11:52 by Steven Van de Craen
Hi PZ, it may be you need the latest version of the WSP. See this discussion here: http://ventigrate.codeplex.com/discussions/586154. Although it may be incompatible in the end. The solution was more relevant for SharePoint 2010.

Monday, 29 Feb 2016 10:37 by Omar
Hi Steven, this solution works for pdf files?

Tuesday, 1 Mar 2016 10:58 by Steven Van de Craen
Hi Omar, I assume you have PDF files stored in SharePoint and want those displayed inside an iframe? This solution should also remove the XFRAMEOPTIONS for PDF files stored in a SharePoint library. However rendering PDF in an iframe also depends on other settings on the client side, but if these are correct it should be no issue.

Tuesday, 24 May 2016 06:01 by sujatha
Hi Steven, I am trying to display documents (PDFs, Word) in an iFrame and the documents are stored in SharePoint. The iframe refused to display any of the documents and that is when I activated your feature on the web apps that hosts the above mentioned document library. Thanks to your solution - files that are 4096KB or less in size get displayed in the iframe without a hitch. But any document over 4096KB does not get displayed. Any ideas why this maybe happening? I appreciate any help you can offer in this regard. Thanks!

Wednesday, 25 May 2016 11:35 by Steven Van de Craen
Hi sujatha, you might want to try increasing the maxRequestLength in the web.config ? <httpRuntime maxRequestLength="102400" executionTimeout="360" />

Friday, 24 Jun 2016 08:41 by sappidi
I am access my SharePoint site in Iframe and Uploding a document to document library. I have a custom page that will display after upload popup. But I am getting Iframe problem for only must custom page. Any Idea how to debug?

Monday, 27 Jun 2016 10:07 by Steven Van de Craen
Hi sappidi, Is the page hosted outside the SharePoint Web App that has this modification active? Can you display that page directly in an iframe (without the redirection)? Try to reproduce with Fiddler active so it might show some insight. Cheers, Steven

Tuesday, 28 Jun 2016 06:37 by FooBar
This doesn't work if the user performs an HTTP POST (e.g. upload file from within the iframe). Works well for displaying pages or any HTTP GET requests. SharePoint seems to invalidate POST request not originating from the same origin, haven't found a workaround for it yet.

Wednesday, 14 Dec 2016 05:16 by Adi
I am having the same problem (This content cannot be displayed in a frame) while trying to render a non-SharePoint web page within an iFrame on SharePoint online site. I don't have an option to add to the web page as it's a third party page. Also, I can't deploy the PermissiveXFrameHeader on Online environment (no wsp's allowed). Please suggest if there's any other way?

Wednesday, 14 Dec 2016 09:12 by Steven Van de Craen
This solution won't work in your case because it modifies SharePoint pages to be run within an iframe, and also because it is a farm solution (on prem only). You're trying to render a page in an iframe but the web server of that page doesn't allow this. The web server will need to be configured to allow this. You cannot control this 'from the outside'.

Monday, 13 Feb 2017 07:33 by kelvinyam
Hi, the solution is great, it solved the problem of pdf document display in iframe. However, when I click a .txt file in iframe, the error message comes out again. any ideas?

CAPTCHA Image Validation