How do I set X-Frame-Options in Cloud Reporting?
Bold Reports® Cloud uses the X-Frame-Options setting to tell the browser whether to allow or restrict page rendering in a frame. This helps prevent click-jacking attacks by keeping your site’s content from being embedded into other sites.
Warning: Please make sure that you are not using iframe based embedding, as it will not work when the X-Frame-Options setting is enabled in Bold Reports®.
When X-Frame-Options is enabled in Bold Reports®, it uses the X-Frame-Options: SAMEORIGIN response header, which will allow the rendering of pages in frames only to the current domain and restrict them in other domains.
By default, X-Frame-Options are disabled, and no restrictions are applied for rendering pages in a frame. The X-Frame-Options response header won’t be added to the request.
How to enable X-Frame-Options
To enable X-Frame-Options, select Enable X-Frame-Options on the X-Frame-Options tab of the Security settings, and then click Save.
When X-Frame-Options is enabled, pages render in a frame only if the parent page is on the same domain as the page.
Warning: Please make sure that you are not using iframe-based embedding, as it will not work when the X-Frame-Options setting is enabled in Bold Reports®. Click iframe-based embedding guide to learn more about iframe-based embedding.
Frequently asked questions
Is X-Frame-Options enabled by default in Cloud Reporting?
No. X-Frame-Options is disabled by default, so pages can render in frames on any domain and the X-Frame-Options header is not added.
Why does my iframe-embedded report not load?
If X-Frame-Options is enabled, your site sends X-Frame-Options: SAMEORIGIN. Browsers then block its pages in frames on other domains, so iframe-based embedding does not work.
Which header value does X-Frame-Options use?
It uses X-Frame-Options: SAMEORIGIN, which allows pages to render in a frame only when the parent page is on the same domain.