title: How to Allow a Site Hosted with Amazon to Be Embedded in an iFrame?
body: <p>I am fairly inexperienced with AWS so this may be an issue of understanding site structure or intricacies between web hosts. </p>
  
  <p>I used to have a site hosted with HostMonster and was able to allow the site to be referenced from an iFrame on another domain. This was achieved by adding the ALLOW-FROM option to the x-frame-options.</p>
  
  <p>The site was recently moved to AWS. It is using S3, EC2, with Elastic Beanstalk. Now when I try to embed the site I get this error:</p>
  
  <blockquote>
    <p>Refused to display '<a href="http://example.com" rel="nofollow">http://example.com</a>' in a frame because it set
    'X-Frame-Options' to 'SAMEORIGIN'.</p>
  </blockquote>
  
  <p>Seems obvious that I have to set this option but I am not clear on how to do so. </p>
  
  <p>I found this <a href="https://forums.aws.amazon.com/thread.jspa?threadID=149569" rel="nofollow">forum asking for support for X-Frame-Options</a>. A response from AWS support confirms that S3 does not currently support X-Frame-Options. </p>
  
  <p>Does this mean I am out of luck or am I just barking up the wrong tree? </p>
  
  <p>I've also looked into the <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/cors.html#how-do-i-enable-cors" rel="nofollow">aws CORS header setting docs</a> and tried allowing the origin I am embedding from and even tried allowing from * to test.</p>
  
  <p>Additionally I and found this <a href="https://gist.github.com/philfreo/3843375" rel="nofollow">GitHub for making S3 files public</a>. I implemented the policy and configuration they have set there but still get the same error.</p>
  
  <p>If it seems like I've left out anything important please ask me about it. Like I said I'm very new to web development and am still figuring things out. </p>
  
  <p><strong>Edit:</strong></p>
  
  <p>As was pointed out it is interesting that a header with X-Frame-Options is being returned at all. Here is the full response I get when I load the page directly.</p>
  
  <blockquote>
    <p>Connection:keep-alive</p>
    
    <p>Content-Type:text/html; charset=utf-8</p>
    
    <p>Date:Sun, 19 Jun 2016 00:31:37 GMT</p>
    
    <p>Server:Apache/2.4.16 (Amazon) OpenSSL/1.0.1k-fips mod_wsgi/3.5 Python/2.7.10</p>
    
    <p>transfer-encoding:chunked</p>
    
    <p>X-Frame-Options:SAMEORIGIN</p>
  </blockquote>