PHP "Header (Location)" Inside Iframe, to Load in _Top Location

PHP header (location) inside IFRAME, to load in _top location?

You are not able to achieve the desired effect in PHP. This is something you'd have to do from JavaScript or add target attribute to <form>:

<form ... target="_top">

PHP Header does not redirect in iframe, no error shown

I just replicated this in my testing environment. Your header is incorrect, there shouldn't be a space between Location and :

Works

header('Location: mypage?redirect=path%2Fto%2Fimg.jpg'); 
die('default'); 

Doesn't work

header('Location : mypage?redirect=path%2Fto%2Fimg.jpg'); 
die('default'); 

PHP Header Location Change of Parent Frame

I have seen the deprecated Meta redirect have a target attribute, but I don't know how widely it is supported.

In Javascript:

top.location.href = "resultpage.htm";

Works only if the top frame is on the same domain as the emitting page.

For a solution that works across domains and without Javascript, the following would work:

<a href="resultpage.htm" target="_top">Continue</a>

Is it possible to use header (Location: ...php); and Section in the same page?

Yes You have to use # for example

header('location:hello.php#3')

How can I access the contents of an iframe with JavaScript/jQuery?

I think what you are doing is subject to the same origin policy. This should be the reason why you are getting permission denied type errors.

Overcoming Display forbidden by X-Frame-Options

I had a similar issue, where I was trying to display content from our own site in an iframe (as a lightbox-style dialog with Colorbox), and where we had an server-wide "X-Frame-Options SAMEORIGIN" header on the source server preventing it from loading on our test server.

This doesn't seem to be documented anywhere, but if you can edit the pages you're trying to iframe (eg., they're your own pages), simply sending another X-Frame-Options header with any string at all disables the SAMEORIGIN or DENY commands.

eg. for PHP, putting

<?php
    header('X-Frame-Options: GOFORIT'); 
?>

at the top of your page will make browsers combine the two, which results in a header of

X-Frame-Options SAMEORIGIN, GOFORIT

...and allows you to load the page in an iframe. This seems to work when the initial SAMEORIGIN command was set at a server level, and you'd like to override it on a page-by-page case.

All the best!

---

Related Topics