I have a custom controller with below code.

namespace Vendor\Module\Controller\Service;
class Login extends \Magento\Framework\App\Action\Action{
protected $_storeManager;
protected $_customerFactory;
protected $_customerSession;
protected $_addressRepository;
protected $_addressDataFactory;
protected $addressFactory;
protected $customerRepository;
protected $checkoutSession;
private $logger;
protected $cart;
public function __construct(
    \Magento\Framework\App\Action\Context $context,
    \Magento\Store\Model\StoreManagerInterface $storeManager,
    \Magento\Customer\Model\CustomerFactory $customerFactory,
    \Magento\Customer\Model\Session $customerSession,
    \Magento\Checkout\Model\Session $checkoutSession,
    \Magento\Checkout\Model\Cart $cart,
    \Magento\Customer\Api\AddressRepositoryInterface $addressRepository,
    \Magento\Customer\Api\Data\AddressInterface $addressDataFactory,
    \Magento\Customer\Model\AddressFactory $addressFactory,
    \Magento\Customer\Api\CustomerRepositoryInterface $customerRepository,
    \Psr\Log\LoggerInterface $logger
) {
    $this->_storeManager     = $storeManager;
    $this->_customerFactory  = $customerFactory;
    $this->cart = $cart;
    $this->_customerSession = $customerSession;
    $this->_addressRepository = $addressRepository;
    $this->_addressDataFactory = $addressDataFactory;
    $this->_addressFactory = $addressFactory;
    $this->checkoutSession = $checkoutSession;
    $this->customerRepository = $customerRepository;
    $this->logger = $logger; 

public function execute() {     
    $customerPin = $this->getRequest()->getParam('pin');
    echo $customerPin;die;


Above code reads the parameter pin from the url and display the parameter value.


This works only if accessed in the same website. Suppose the controller is accessed like iframe, from the other domain. its showing blank screen.

is there any setting to be done? from research i found we need to set X-Frame-Options to make it work.

if so how that can be set from controller?

Can anyone look into this and update me the solution please.

  • will $this->getRequest()->getPost('pin'); might work? – fmsthird Apr 4 '19 at 11:55
  • @magefms, not cleared with your comment..yes that will give the param value – jafar pinjar Apr 4 '19 at 11:56
  • I mean maybe try using getPost() instead of getParam and it might work – fmsthird Apr 4 '19 at 11:58
  • 1
    @magefms, not getPost() not working, tried it – jafar pinjar Apr 4 '19 at 11:59
  • I think your endpoint is not giving you the data – fmsthird Apr 5 '19 at 3:22

Assuming you have defined your webapi endpoint like this:


Then you can get the Post Value like this:


Otherwise, you will get a blank response when an endpoint is called inside an iframe.


I think you are trying to include a local environment into a iframe but that is not possible. The outside world can not access http://localsite/test/service/login/pin/6

  • no, i am not calling local, just given u the sample example there – jafar pinjar Apr 4 '19 at 11:53
  • Okay, to set the headers you could try: $this->getResponse()->setHeader('X-Frame-Options', 'ALLOW'); – M4RT13N Apr 4 '19 at 12:05
  • in first line of execute method? – jafar pinjar Apr 4 '19 at 12:06
  • Yes, I think so. But did not try it. Got the idea from magento.stackexchange.com/questions/92105/… – M4RT13N Apr 4 '19 at 12:08
  • Tried, but that did not work for me – jafar pinjar Apr 4 '19 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.