使用 X-Frame-Options 有三個可選的值:
DENY
:瀏覽器拒絕當前頁面加載任何Frame頁面SAMEORIGIN
:frame頁面的地址只能為同源域名下的頁面ALLOW-FROM
:origin為允許frame加載的頁面地址
<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <httpProtocol> <customHeaders> <add name="X-Frame-Options" value="ALLOW-FROM" /> </customHeaders> </httpProtocol> </system.webServer> </configuration>
<configuration><system.webServer><httpProtocol><customHeaders><add name="X-Frame-Options" value="DENY" /></customHeaders></httpProtocol></system.webServer></configuration>