Load denied by X-Frame-Options: https://mydomain.mysite.com/blah/blah.jsp does not permit cross-origin framing

Question

We have a site running in HTTPS and are configuring XPM. We've enabled Tridion CM to run HTTPS as well following the docs on SDL Live (http://sdllivecontent.sdl.com/LiveContent/content/en-US/SDL_Tridion_2011_SPONE/task_FC687109502D4F29BBC8E7222A9C117A). We are now getting the following error when clicking the Tridion Site Edit button from the top left of the website page:

Load denied by X-Frame-Options: https://mydomain.mysite.com/blah/blah.jsp does not permit cross-origin framing.

What does this mean?

Answer 1

It is important to know that XPM actually loads yout website in an iFrame. So if you have set your HTTP headers to disallow this, then the error occurs.

This answer helped: https://stackoverflow.com/a/10174077

We use IPlanet, so on the web server we removed the HTTP header restriction to disallow embedding our site into an iframe. This did the trick.

Answer 2

In case you are not able to configure the Web Server to drop the header, a Chrome extension will do the trick as well:

Source: https://gist.github.com/dergachev/e216b25d9a144914eae2

Chrome Store: https://chrome.google.com/webstore/detail/ignore-x-frame-headers/gleekbfjekiniecknbkamfmkohkpodhe