Refused to display "https://.." in a frame because it set ' X-frame-Options' to 'sameorigin'

[#1]

Hi all,

I am integrating BO report into custom SAPUI5 application using <html:iframe> in XML view,but the BO report is not getting displayed due to different domains, browser is blocking it.

I found different solutions over internet using Destinations( we do not have SCP), URL Whitelisting and Setting response header to allow different origins instead of same origin.

OData services are based on ABAP.

Please guide me teh best way to fix this issue.

Regards,

venkatesh.

[Joseph_BERTHE1]

Hello,

What you have to do is to have access to your Fiori launchpad through a webdispatcher.

In that manner you will be able to rewrite the internal and external URL to match to the same domain.

With that configuration you avoid the CORS issue.

This is also the recommended architecture by SAP.

Kind regards,

Joseph

[Venkatesh_Machineni]

Hi joseph.berthe,
Thanks for your reply.

Can we do it in Client side (UI5 app) instead on server?

Regards,

venkatesh

[Joseph_BERTHE1]

venkatesh.machineni in production perspective it is not possible. Look at this article What is CORS.