Search code examples
phpiframeaccess-controlx-frame-options

Access Control Allow Headers not allowing contents of an iframe to load

I have two php pages in the same directory. These are edit_page.php and page.php.

edit_page.php has a wysiwyg editor where I can edit the contents of another page through an iframe. the source for the iframe is page.php with a query ?page_id=XXX.

When I go to page.php?page_id=XXX I can see the following headers:

enter image description here

However when I go to edit_page.php?page_id=XXX I see the following errors in the console:

enter image description here

I tried putting the headers in the page sending the request just for the laugh even though I know that it is making the request and not sending the response header.... worth a try :P

enter image description here

The headers I'm sending are:

header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: GET, POST");
header("Access-Control-Allow-Headers: Content-Type");
header("X-Frame-Options: *");

I'm a bit stuck with this one I've never come across this kind of issue before. If anyone can point me in the right direction that would be greatly appreciated.

Also if anyone can explain why this is happening in the first place that would be great. My understanding was that this would happen with pages from a cross origin e.g. loading content from an external source not on the same domain. But obviously these two files are not only on the same domain but in the same directory.

Solution

  • Ok now I feel stupid....

    I had:

    <iframe name="richTextField" id="wysiwyg" src="page?page_id=1"></iframe>

    Instead of:

    <iframe name="richTextField" id="wysiwyg" src="page.php?page_id=1"></iframe>

    Going brain dead I think