Skip Navigation
Allow_from attribute not working in Clickjackprevention widget
Answer ID 9791   |   Last Review Date 03/22/2022

How can I allow my CP page to be displayed in an iframe on a specific site?


Customer Portal (CP)
Oracle B2C Service - August 2017


When allowing a Customer Portal (CP) page to be displayed in an iframe on a certain site (not on all sites), the standard utils/Clickjackprevention widget has to be customized by adding the "allow_from" attribute to the code.

However, when setting the value for this attribute, one must consider what type of URL is provided as a value.  For instance, a code such as:

<rn:widget path="utils/ClickjackPrevention" allow_from="" />

will not work.

The value set has to be in the form of "" and the code should look like:

<rn:widget path="utils/ClickjackPrevention" allow_from="" />

<rn:widget path="utils/ClickjackPrevention" allow_from="*" />

The utils/ClickjackPrevention widget will automaticly append the HTTP/HTTPS

Should the above all_from fail, this convention may also be helpful.

<rn:widget path="utils/ClickjackPrevention" allow_from="" />