Refused to display 'url' in a frame because it set 'X-Frame-Options' to 'deny'

Retired Boards Appdev Tools

Topic summary

Embedded Shopify app fails to render in an iframe on a Linux server due to the HTTP header X-Frame-Options: DENY. This header tells browsers to block framing; embedded apps must not send DENY.

Key guidance: Using koa-shopify-auth already handles OAuth/redirects; the issue is server headers. Ensure your web server does not set X-Frame-Options: DENY.

Resolution (for one setup):

  • Remove/override X-Frame-Options in Nginx (add_header X-Frame-Options “”).
  • Check included configs (e.g., cipherli.st ssl-params.conf) that may re-add DENY and remove it there.
  • Reload Nginx and verify via: wget -q --server-response https://your.url.com. Note: adding lusca xframe in Koa wasn’t needed in the final fix.

Ongoing issues: Some still see the error after adding add_header and proxy_hide_header, or after service restarts. One suggestion: use Cloudflare Workers to rewrite headers on the fly.

Open question: A redirect to Shopify domains (e.g., admin.shopify.com) returns X-Frame-Options: DENY from Shopify; users asked if it can be overridden. No confirmed solution in thread.

Status: Original poster’s issue resolved by removing server-set DENY. Broader cases involving upstream Shopify headers remain unresolved.

Summarized with AI on December 21. AI used: gpt-5.
4

Thank you for your guidance. I focused on removing X-Frame-Options from multiple places like so to get it resolved.

server.js using koa I added the following -

const lusca = require('koa-lusca');

app.prepare().then(() => {
  const server = new Koa();
  server.use(lusca.xframe({value: ''}));

Then in the nginx.conf apply the following -
add_header X-Frame-Options “”;

As well as here if you are using snippets from https://cipherli.st/
./snippets/ssl-params.conf
remove

add_header X-Frame-Options DENY;

reload nginx and start application and then it will be resolved.

My main issue is that I forgot about the cipherlist configuration I extend from the nginx.conf was overwriting the headers with DENY.

Also to verify you removed the header correctly, use this command to check while application and nginx is up.

wget -q --server-response https://${your.url}.com

1 Like