Laravel 4 refuses to load iframe due to 'X-Frame-Options' to 'SAMEORIGIN'

问题

I am building a chrome extension in which I am showing an iframe on a popup from the Gmail home page. As Gmail home page is in HTTPS , my iframe should also be in https. I configured apache2 by enabling mod_ssl and got HTTPS working on apache2. I made a native PHP page and tried to show that on the frame which is on Gmail page. I had no problems it was loading the page from localhost. But when I wanted to use a Laravel backend, it showed me error.

Refused to display 'https://localhost/laravel/laravel/public/index.php/chromelogin' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Any Suggestions??

回答1:

Add following line in your bootstrap/start.php file:

$app->forgetMiddleware('Illuminate\Http\FrameGuard');

回答2:

You can create a service provider and put this in the register() function

$this->app->forgetMiddleware('Illuminate\Http\FrameGuard');

This way you can put in logic if you don't want to disable it for your whole application.

回答3:

This is removed since 4.2

Removing this by default in 4.2. Should be in an after filter - will leave FrameGuard class so people can add the middleware manually if they want.

-- Taylor Otwell

You can confirm this If you look at the source code or search your project folder so you can see that the class is still under Illuminate\Http\Middleware but the only reference to it is in vendor/laravel/framework/src/Illuminate/Foundation/Console/Optimize/config.php:

$basePath.'/vendor/laravel/framework/src/Illuminate/Http/Middleware/FrameGuard.php',

来源：https://stackoverflow.com/questions/24082504/laravel-4-refuses-to-load-iframe-due-to-x-frame-options-to-sameorigin