We need one of our website available in a iframe on a different domain.

The problem is that X-Frame-Options blocks the request and you can not use the * or ALLOW-FROM uri anymore. Please see link for additional info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

From what I read CSP frame-ancestors does the same however I can't seem to find a good option to disable X-Frame-Options out of the .env file and to only use CSP's.

What would the recommended approach be for running Magento in a iframe on a different domain?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.