Html iframe 拒绝显示
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/31944552/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
iframe refuses to display
提问by Jose M.
I am trying to load a simple iframe into one of my web pages but it is not displaying. I am getting this error in Chrome:
我正在尝试将一个简单的 iframe 加载到我的一个网页中，但它没有显示。我在 Chrome 中收到此错误：
Refused to display 'https://cw.na1.hgncloud.com/crossmatch/index.do' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' https://cw.na1.hgncloud.com".
Invalid 'X-Frame-Options' header encountered when loading 'https://cw.na1.hgncloud.com/crossmatch/index.do': 'ALLOW-FROM https://cw.na1.hgncloud.com' is not a recognized directive. The header will be ignored.
This is the code for my iframe:
这是我的 iframe 的代码：
<p><iframe src="https://cw.na1.hgncloud.com/crossmatch/" width="680" height="500" frameborder="0"></iframe></p>
I am not really sure what that means. I have loaded plenty iframes before and never received such errors.
我不太确定这意味着什么。我之前加载了很多 iframe，但从未收到过这样的错误。
Any ideas?
有任何想法吗？
Thanks
谢谢
回答by Vince
It means that the http server at cw.na1.hgncloud.comsend some http headers to tell web browsers like Chrome to allow iframe loading of that page (https://cw.na1.hgncloud.com/crossmatch/) only from a page hosted on the same domain (cw.na1.hgncloud.com) :
这意味着 http 服务器会cw.na1.hgncloud.com发送一些 http 标头以告诉 Chrome 等网络浏览器仅允许从同一域上托管的页面（https://cw.na1.hgncloud.com/crossmatch/）加载该页面（https://cw.na1.hgncloud.com/crossmatch/）的iframe cw.na1.hgncloud.com）：
Content-Security-Policy: frame-ancestors 'self' https://cw.na1.hgncloud.com
X-Frame-Options: ALLOW-FROM https://cw.na1.hgncloud.com
You should read that :
你应该读到：
回答by David
The reason for the error is that the host server for https://cw.na1.hgncloud.comhas provided some HTTP headers to protect the document. One of which is that the frame ancestors must be from the same domain as the original content. It seems you are attempting to put the iframe at a domain location that is not the same as the content of the iframe - thus violating the Content Security Policy that the host has set.
报错的原因是https://cw.na1.hgncloud.com的主机服务器提供了一些HTTP头来保护文档。其中之一是框架祖先必须来自与原始内容相同的域。您似乎试图将 iframe 放在与 iframe 内容不同的域位置 - 从而违反了主机设置的内容安全策略。
Check out this link on Content Security Policyfor more details.
有关更多详细信息，请查看内容安全策略上的此链接。
回答by Volomike
For any of you calling back to the same server for your IFRAME, pass this simple header inside the IFRAME page:
对于为 IFRAME 回调到同一服务器的任何人，请在 IFRAME 页面内传递这个简单的标头：
Content-Security-Policy: frame-ancestors 'self'
Content-Security-Policy: frame-ancestors 'self'
Or, add this to your web server's CSP configuration.
或者，将其添加到您的 Web 服务器的 CSP 配置中。
