2

I'm running a store with Magento 1.9.0.1. It's setted up to process payments with Paypal Pro but I have a problem. Everytime I make a payment I don't get redirected to the success page, instead I have on the javascript console this error:

Invalid 'X-Frame-Options' header encountered when loading 'https://securepayments.sandbox.paypal.com/webapps/HostedSoleSolutionApp/webflow/sparta/hostedSoleSolutionProcess?execution=e1s1': 'ALLOW' is not a recognized directive. The header will be ignored.

I tried everything but I seem not to be able to resolve this problem.

Can anyone help me? Thanks.

1 Answer 1

2

The Problem

The problem you encounter is, that Paypal sends a wrong X-Frame-Options header.

The allowed headers are:

DENY
  A browser receiving content with this header field MUST NOT
  display this content in any frame.

SAMEORIGIN
  A browser receiving content with this header field MUST NOT
  display this content in any frame from a page of different origin
  than the content itself.

  If a browser or plugin cannot reliably determine whether or not
  the origin of the content and the frame are the same, this MUST be
  treated as "DENY".

  Please note that current implementations vary on the
  interpretation of this criteria.  In some, it only allows a page
  to be framed if the origin of the top-level browsing context is
  identical to the origin of the content using the X-Frame-Options
  directive; in others, it may consider the origin of the framing
  page instead.  Also see Section 2.3.2.2 for more details on the
  nesting of frames and variations in the handling of this header
  field by different browsers.  In addition, refer to Section 4,
  paragraph 2 for the resulting potential security problems.

ALLOW-FROM  (followed by a serialized-origin [RFC6454])
  A browser receiving content with this header MUST NOT display this
  content in a frame from any page with a top-level browsing context
  of different origin than the specified origin.  While this can
  expose the page to risks by the trusted origin, in some cases, it
  may be necessary to allow the framing by content from other
  domains.

You should contact paypal. But I think many others will have this problem too and hopefully paypal already fixes this.

So what to do?

Check the HTTP Header, if you find the header X-Frame-Options: ALLOW, then they sending a RFC INvalid header, therefore your browser is right, and they are wrong. The bad part is to convince them. What browser do you use?

5
  • Thank you. The fact is that after trying countless solutions I already tried contacting Paypal and they told me it's not a problem on their part. I really don't know where to look for help.
    – Giovanni
    Aug 26, 2014 at 15:09
  • Check the HTTP Header, if you find the header X-Frame-Options: ALLOW, then they sending a RFC INvalid header, therefore your browser is right, and they are wrong. The bad part is to convince them. What browser do you use? Aug 26, 2014 at 15:18
  • 1
    Yes, that's exactly the case (imgur.com/jotLp0A). I encountered this error in every browser I tried (Chrome, Chrome Beta, Safari, FF, IE). I tried contacting their technical support team, let's see what they're gonna tell me. Thank you very much for your help.
    – Giovanni
    Aug 27, 2014 at 8:28
  • One year later, same problem, what did they told you? Oct 14, 2015 at 9:31
  • 1
    Sorry for the very late response, but they just told me it wasn't a problem on their end, so none of their business.
    – Giovanni
    Jul 13, 2017 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.