6

I am having an issue with viewing a PDF in an object element in Chrome. The initial PDF loads, but when I go to a different HTML, then HREF, it will not display. I 'think' I am getting the following error because Chrome uses an external viewer and thinks I am crossing domains. I do not get this error in FF or IE.

Refused to display 'https://docs.google.com/viewer?url=http%3A%2F%2Fleaderpaper.com%2Fleader%2Fspecs%2F10-openend.pdf' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

My current workaround is to give the HREF a _blank target attribute which opens in a new tab. Have I done all I can??

Improve this question
7
  • "when I go to a different HTML, then HREF, it will not display" - what do you mean by this? "then HREF"? You aren't requesting a PDF directly, you are trying to display the output of the Google Docs PDF viewer, which is plain old HTML. So, I don't see how this has anything to do with Chrome's internal PDF viewer. Same origin policy still applies though.
    – DocRoot
    Apr 21, 2016 at 22:43
  • I have an object with that displays an HTML page with an HREF to a PDF.
    – Michael Tuma
    Apr 22, 2016 at 14:40
  • You mean you are linking to a PDF in an anchor? And "then HREF" refers to clicking on this anchor?
    – DocRoot
    Apr 22, 2016 at 14:48
  • The initial call is through JS, but that should not matter. My understanding is that Chrome does not support local PDF plugin, therefore it uses the Google Docs viewer, which as you can see from the error is in a different domain than leaderpaper.com.
    – Michael Tuma
    Apr 22, 2016 at 14:49
  • 1
    @DocRoot Yes. <td><a href="/leader/specs/10-openend.pdf" target="_blank"><img class="pdf" src="/leader/img/pdf.png" alt="PDF" /></a>
    – Michael Tuma
    Apr 22, 2016 at 14:54

1 Answer 1

Reset to default
0

The error message you're seeing, "Refused to display 'https://docs.google.com/viewer?url=http%3A%2F%2Fleaderpaper.com%2Fleader%2Fspecs%2F10-openend.pdf' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'", indicates that the website you're trying to embed in an iframe (the Google Docs PDF viewer) has set the X-Frame-Options header to 'SAMEORIGIN'. This header prevents the page from being displayed in an iframe on a different domain for security reasons.

This behavior is intended to prevent clickjacking attacks, where a malicious website could try to trick users into performing actions on a different site without their knowledge.

Your workaround of opening the PDF in a new tab with the _blank target attribute is a common solution to this issue. When you open the PDF in a new tab, you're essentially loading it in a separate browsing context, so the same-origin policy and X-Frame-Options header restrictions do not apply.

So, you've done what you can to work around the issue within the constraints of how the website you're embedding handles iframe embedding. Opening the PDF in a new tab is a practical solution when you encounter X-Frame-Options restrictions, and it's generally user-friendly since it ensures the PDF can be viewed without issues in most browsers.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.