Question
Enable X-Frame-Options in PRPC 5.5
Hi,
We have an application running on PRPC 5.5 and want to enable X-Frame-Options in web.config.
If we set it to SAMEORIGIN we are facing one issue where portal is not showing heading logo in top left section.
How can we make this work? Is there any specific rule that pega has in PRPC5.5 to enable x-frame-options.
Thanks!
-- Edit
Observed that none of gif and png images are getting displayed.
after looking at various tech discussions/forums it seems issue is with response header X-Content-Type-Options: nosniff, which gets added when x-frame-options is enabled.
Since it is set to nosniff, it will check the Content-Type and actual resource type and if they do not match then browser will not render the image.
It seems in our application we have create binary file rules and images uploaded there does not match with image extension mentioned in the rule.
Thanks for the help.
Hi AkshayG2,
We also have the similar security issue. Please share the detail of how you configured X-Frame-Options and also how you resolved the images not rendering.
Please share your web.config file or the changes updated..
Thanks in advance..
Hi,
Thank you for posting your query in the PSC. This looks like an inactive post and hence, we suggest you create a new post for your query. Click on the Write a Post button that’s available on the top right pane of this page. Once created, please reply back here with the URL of the new post.
You may also refer this discussion link as a reference in the new thread.
Hi Akshay
There is nothing in version 5.5 that allows you to set that header. Assume you have set this up in IIS similar to what this article describes: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
You may want to try and run this in IE/Chrome developer tools to see if there is any console info that describes what is happening to your gif and image files.