"Refused to display document because display forbidden by X-Frame-Options."

Hi,

I’m trying to use Google gomap in javascript. Whenever I add the “https://www.google.com/jsapi” to the list of javascripts, I got the error “Refused to display document because display forbidden by X-Frame-Options”.

Following are my simple scripts:

JsLabel.java:

package org.vaadin7demo.blog;

@SuppressWarnings(“serial”)
//
@com.vaadin.annotations.JavaScript({
https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js”,
“js_label.js”,“https://www.google.com/jsapi” })
public class JsLabel extends com.vaadin.ui.AbstractJavaScriptComponent {

public JsLabel(final String xhtml) {
    getState().xhtml = xhtml;
}

@Override
protected JsLabelState getState() {
    return (JsLabelState) super.getState();
}

}

JsLabelState.java:

package org.vaadin7demo.blog;

import com.vaadin.shared.ui.JavaScriptComponentState;

@SuppressWarnings(“serial”)
public class JsLabelState extends JavaScriptComponentState {
public String xhtml;
}

js_label.js:

org_vaadin7demo_blog_JsLabel = function() {
var e = this.getElement();
//google.load(‘visualization’, ‘1’, {‘packages’: [‘geomap’]
});

this.onStateChange = function() {
	e.innerHTML = this.getState().xhtml; 
}

}

Any help is appreciated!! Thank you!

By googling your error-message, I came across this:
http://www.rivercitystudio.com/blog/2011/09/google-maps-embedding-x-frame-options-change/
.

Thank you. I found this too, but didn’t work. I also found that, there’s no such error in firefox and IE. Only in Chrome, I kept getting that error when inspecting element

I’m trying to make custom javascript vaadin google map component, but I’m facing with the same problem.

On page load in console is log:
Refused to display ‘http://maps.googleapis.com/maps/api/js?sensor=false&output=embed’ in a frame because it set ‘X-Frame-Options’ to ‘SAMEORIGIN’.

despite the fact that I used
“&output=embed”
parameter in url.

I found some hacky soluction that works:
Insted of using @JavaScript annotation to load google maps api in my custom javascript component code I use this code:


var gmap = gmap || {};

gmap.GMap = function(element) {
	this.element = element;
	this.element.innerHTML = "<div id='map-canvas' style='height:100%; width:100%;'></div>";

	$(function() {
		window.initialize = function() {
			var mapOptions = {
				zoom : 8,
				center : new google.maps.LatLng(-34.397, 150.644),
				mapTypeId : google.maps.MapTypeId.ROADMAP
			};

			var map = new google.maps.Map(
					document.getElementById('map-canvas'), mapOptions);
		};

		var script = document.createElement('script');
		script.type = 'text/javascript';
		script.src = 'https://maps.googleapis.com/maps/api/js?v=3.exp&sensor=false&'
				+ 'callback=initialize';
		document.body.appendChild(script);
	});
};

I had the same problem: I had an embedded Google Maps iframe that I wanted to load only when scrolled over. The URI already had “embed=options”.

The first though was setting the src on the fly (in jQuery that would be $(‘#map’).attr(‘src’, 'http://…");), but that caused the X-Frame-Options error.

The workaround in this case is to just move the whole

I’m facing the same issue. None of the solutions worked for me. Loading javascript in runtime looks like a good idea, but due to some reason vaadin reloads a page when I append the script to the head or body. Also, I don’t get the meaning of the error. I’m just trying to load the script (https://www.google.com/jsapi), I’m not trying to embed any iframes…

I was able to solve this issue in a way, similar to the one described by Łukasz Śliwiński. I just needed to add a
callback
parameter to google.load, so that instead of reloading the whole page on loading visualization library, it would call the specified method.

var thisObj;
function cz_vutbr_fit_simulatormanager_jscomponents_enginespanel_EnginesPanel() {
    window.thisObj = this;
    //as soon as script is loaded, loadVisualizationLibrary
    loadScript("https://www.google.com/jsapi", loadGoogleVisualizationLibrary);
    console.log("this.getElement 2"+this.getElement().innerHTML);
}

function loadGoogleVisualizationLibrary () {
    var e = thisObj.getElement();
    google.load("visualization", "1", {
        packages : [ "gauge" ]
,
        "callback" : initMyComponent
    });    
};

function loadScript(url, callback)
{
    // Adding the script tag to the head as suggested before
    var head = document.getElementsByTagName('head')[0]
;
    var script = document.createElement('script');
    script.type = 'text/javascript';
    script.src = url;
    // Then bind the event to the callback function.
    // There are several events for cross browser compatibility.
    script.onreadystatechange = callback;
    script.onload = callback;
    // Fire the loading
    head.appendChild(script);
}

function initMyComponent() {
    thisObj.onStateChange = function() {
    }
    //code for drawing charts goes here
}

If you are using Spring Security, you have to override default behavior. Add in your spring security config the following:

<http> 
    <headers> 
        <frame-options policy="SAMEORIGIN"/> 
    </headers> 
</http>

read
here
for more informations:

String url = “https://www.surveymonkey.com/oauth/authorize?client_id=sm_girishjamba_gmail_com&api_key=fdg2mfe7d9h24sq2r538mqa6&response_type=code&redirect_uri=http://aureusrndmac11315.cloudapp.net/SurveyMonkey/home.jsp”;
Embedded embedded = new Embedded(null, new ExternalResource(url));
embedded.setType(Embedded.TYPE_BROWSER);

I am using above code to embedd a url in my application and it gives me below error in crome however its working fine in firefox. Any sugesstion will be help full.

Kindly note when i copy past the url in address bar then it works fine in crome however it doesnt work when used in vaadin component and crome.

Error :
Refused to display ‘https://www.surveymonkey.com/oauth/authorize?client_id=sm_girishjamba_gmail…e&redirect_uri=http://aureusrndmac11315.cloudapp.net/SurveyMonkey/home.jsp’ in a frame because it set ‘X-Frame-Options’ to ‘DENY’.

Thank you,this proposal solves my problem