Background: I'm integrating an external CMS into Magento, and using a module in Magento to render the preview for the CMS. This happens within an iFrame.

In Magento the core/domainpolicy observer was added which allows for the X-Frame-Options header to be set for admin and frontend.

In my instance, this header is preventing me from using my preview route (/my/content/preview for example) from being loaded within an iFrame from the CMS>

How can I disable this functionality for a specific controller?

It's observing the controller_action_predispatch event.

2 Answers 2


Examining the core/domainpolicy model to see what it does, it:

  • Determines the Magento area
  • Loads the security policy for the area (from configuration). This setting comes straight from a select box in admin System -> Configuration.
  • Converts the result to an internal code for the option
  • Checks the result is truthy and if so:
  • Adds the X-Frame-Options header

This is not giving you much flexibility for changing the default behaviour. The only real choice is to extend the method and add your own logic to prevent it, for example:

# File: app/code/local/Vendor/Module/Model/Domainpolicy.php
 * Add ability to disable the X-Frame-Options header for certain controllers
class Vendor_Module_Model_Domainpolicy extends Mage_Core_Model_Domainpolicy
     * Add X-Frame-Options header to response, depends on config settings
     * @param  Varien_Object $observer
     * @return self
    public function addDomainPolicyHeader($observer)
        if (Mage::registry('disable_x_frame_options_header')) {
            return $this;
        return parent::addDomainPolicyHeader($observer);

Note! The core Mage module uses the full class name of the Domainpolicy observer in its definition, which means you can't extend it using the normal Magento rewrite system. You can either:

  • Re-define the event definition in your module's config.xml file (which takes priority because it's loaded later than core), or
  • Use a file-based override of the entire class

The first option is better to me. This means you redefine the entire event declaration, only changing the class name to your own.

This will work on the fact that you set a Magento registry item which the observer can catch to determine that it shouldn't add the header.

All you need to do is add it to your controller in the preDispatch() method. You will see that Mage_Core_Controller_Varien_Action::preDispatch() is the point where the controller_action_predispatch event is dispatched - this is where the observer will be fired, so ensure you add the logic before the parent method's logic:

# File: app/code/local/Vendor/Module/controllers/PreviewController.php
 * Do not add X-Frame-Options headers
 * @return self
public function preDispatch()
    Mage::register('disable_x_frame_options_header', true, true); // third arg: graceful
    return parent::preDispatch();
  • This is a pretty creative solution, Robbie. I haven't had to do so in a while but do you think this approach is generalizable to other situations where a core Mage module uses the full class name of an over server in its definition? Any idea why this is done for some observers and not others? Is it to prevent extending it using the normal rewrite system? Aug 9, 2016 at 1:26
  • 1
    Hey Bryan. Why it's done like that is anyone's guess. I would imagine it's a difference of application between the Magento core developers. Yes, you can use this approach for other situations in Magento core. The config XML system is built to be overrideable if you redefine an element in a module that is loaded last - you can ensure that happens by choosing the local pool over community, community over code, adding a <depends> tag to force your module to load after the original, or simply naming your module something that is later in the alphabet e.g. Z_Mymodule - hope this helps.
    – scrowler
    Aug 9, 2016 at 1:29

There is the option in backend (I use Magento 1.9.3)

Configuration -> Admin -> Allow Magento Backend to run in frame

Its not for a specific root but works fine for me. You can check by http://lycenok.com/http-request/request.php

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.