Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to display an Excel document from SharePoint2010 Excel Services in an iframe. But I'm getting an error due to the x-frame-options header. I have access to the to SharePoint server and all online searches tell me to go to IIS Manager -> HTTP Response Headers to remove it. But it's not there.

I tried adding my own header as suggested here: http://stackoverflow.com/questions/6666423/overcoming-display-forbidden-by-x-frame-options to no avail.

I also tried changing a SharePoint setting suggested here: Disabling X-FRAME-OPTION: SAMEORIGIN HTTP Response Header on SharePoint/PowerPivot xlsviewer.aspx. That didn't work either.

It's not a proxy adding it or anything because other SharePoint sites on the network do not have the header.

Is there another place x-frame-options could be set?

UPDATE: After more investigating, it turns out only the SharePoint Excel Services page (xlviewer.aspx) includes x-frame-options = SAMEORIGIN. So one would assume there's a setting in SharePoint.

share|improve this question
up vote 0 down vote accepted

So it doesn't look like you can turn it off in SharePoint Admin. I ended up installing an HttpModule to strip out offending header and it works great. http://ventigrate.codeplex.com/releases/view/79825

share|improve this answer
    
Removing the X-Frame-Options: SAMEORIGIN header will expose your site to Clickjacking attacks. You should use X-Frame-Options: ALLOW-FROM https://www.example.org or, better, replace it with Header set content-security-policy frame-ancestors 'self' https://www.example.org. – Mircea Vutcovici May 24 at 17:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.