I am working on a website that hides your history for when you search on it
function code(url) {
var win = window.open();
win.document.body.style.margin = '0';
win.document.body.style.height = '100vh';
var f = win.document.createElement("iframe");
window.focus();
// url is already declared in function
if (!url) return;
f.style.width = "100%";
f.style.height = "100%";
f.style.border = 'none';
f.style.margin = '0';
win.document.body.appendChild(f);
f.src = url
}This is the javascript code for it.
When it goes to youtube, there is an error in inspect element that reads
Refused to display 'https://www.youtube.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'
Is there a way to fix this?
No, you can't.
The server may not allow iframes to be loaded for security reasons.
You have to understand that an iframe can be resized and opacified with css and still be clickable. This can be a security risk for users who may unintentionally interact with an application where they may be logged in.
The server will allow it if no X-Frame-Options are present in the http header in the http response.
In this case, YouTube will block it by setting X-Frame-Options : DENY or X-Frame-Options: SAMEORIGIN in their http response.