X-Frame SAMEORIGIN

[dmfranko]

Hello,

Is there any way in ServiceNow to add trusted origins, as opposed to opening things up to all origins below?   What I'd like to do is embed UI Pages from ServiceNow in a Drupal site.

Thanks!

glide.set_x_frame_options

Enable this property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. https://developer.mozilla.org/en/the_x-frame-options_response_header Default: Yes

[rlatorre]

Have you had any response on this question? We have the same need.

[dmfranko]

I think I asked HI about this and there was no way to just add trusted origins.   It's all or nothing.   In my case we ended up using the API and building a page using AngularJS.

[rlatorre]

Thanks Dan. We opened our own ticket. It will probably be followed by an enhancement request that will get little traction.

[Roger19]

Enhancement request has been raised in order to support the "X-Frame-Options: allow-from https://example.com/" whitelisting Kind of options.
If you need it please raise an incident on HI to get assigned to it  🙂