When trying to share a Liferay portlet to an external site, users may encounter connection/authentication errors.
Steps to Reproduce:
- Add Blog Portlet (or any portlet) to a page
- Add a Blog to the Blog Portlet
- Select Configuration > Sharing and copy the script and select to share to external sites
- Open a new Liferay Instance on a different IP
- Add a Web Content Display Portlet to the page
- Add an article
- Select Source and add the Script
- In Internet Explorer (IE) 10, view the page with the Web Content article
Expected Result:
Portlet appears in external site.
Actual Result:
Portlet does not appear. In IE, the user receives a, "This content cannot be displayed in a frame," message inside the Web Content Display (appears to be an IE message, not Liferay).
In Firefox, Web Content Display is blank.
Resolution
This issue is resolved by setting the below property in the portal-ext.properties file:
# If the property "http.header.secure.x.frame.options" is set to true, then # the portal will iterate through the properties # "http.header.secure.x.frame.options.*" where the wildcard "*" # is replaced with an int number starting from 0 and ending with 255 to find # a pipe (|) delimited URL and HTTP header value pair (e.g. "/|SAMEORIGIN"). # # Upon finding a matched a URL, the portal will use the custom HTTP header # value instead of the "DENY" value. # # By default, URLs that start with "/" will use a custom HTTP header value # of "SAMEORIGIN". Specify another URL and HTTP header value with a number # smaller than 255 to intercept this default behavior. # http.header.secure.x.frame.options.255=/|SAMEORIGIN
For example, if I want to share Blog widgets, I would set the property in the below manner: http.header.secure.x.frame.options.1=/widget/web/guest/home/-/blogs