Show TOC

Frame OptionsLocate this document in the navigation structure

frameOptions is used to prevent security vulnerabilities like clickjacking. With the frameOptions configuration you define whether SAPUI5 is allowed to run embedded in a frame or only from trusted origins or not at all.

SAPUI5 provides the following configuration options for frameOptions:

Mode

Default

Description

allow

X

Allows to be embedded from all origins

deny

Denies to be embedded from all origins

trusted

Allows to be embedded from trusted origins according to the same-origin policiy and to be embedded to origins allowed by the whitelist service

With frameOptionsConfig the following additional configuration options can be set:

Parameter

Type

Default

Description

callback

function(bSuccess)

Function that is called with the success state

Note

The function can be synchronously called from the SAPUI5 bootstrap script. The DOM (document.body) may not be accessible.

timeout

number

10000

After the delay, the page remains blocked and the provided callback is invoked (milliseconds)

blockEvents

boolean

true

Defines whether keyboard, mouse and touch events are blocked

showBlockLayer

boolean

true

Defines whether an invisible block layer is rendered to prevent interaction with the UI

allowSameOrigin

boolean

true

Defines whether same origin domains are allowed or not

whitelist

string

Contains the domain whitelist (comma-separated)

Example: deny

If the application is not intended to run in a frame, set frameOptions to deny:

<script id='sap-ui-bootstrap'
    src='resources/sap-ui-core.js'
    data-sap-ui-frameOptions='deny'>
</script>
Example: trusted with callback

To restrict the embedding to same-origin domains, set frameOptions to trusted. The callback in the following code sample is called with a boolean as success state and can be used to implement an application-specific behavior.

<script>
window["sap-ui-config"] = {
    frameOptions: 'trusted',
    frameOptionsConfig: {
        callback: function(bSuccess) {
            if (bSuccess) {
                alert("App is allowed to run!");
            } else {
                alert("App is not allowed to run!");
            }
        }
    }
};
</script>
<script id='sap-ui-bootstrap'
    src='resources/sap-ui-core.js'>
</script>
Example: Whitelist Service

To allow that the SAPUI5 application is embedded in cross-origin domains, configure a whitelist service. The whitelist service checks whether the application can run in the parent origin, or not.

<script>
window["sap-ui-config"] = {
    whitelistService: 'url/to/whitelist/service',
    frameOptions: 'trusted',
    frameOptionsConfig: {
        callback: function(bSuccess) {
            if (bSuccess) {
                alert("App is allowed to run!");
            } else {
                alert("App is not allowed to run!");
            }
        }
    }
};
</script>
<script id='sap-ui-bootstrap'
    src='resources/sap-ui-core.js'>
</script>
Example: Whitelist Service via <meta> Tag

Alternatively, a <meta> tag can be used to configure the whitelistService and set the frameOptions to trusted. This only applies if the whitelistService or frameOptions configuration is not set in the SAPUI5 configuration.

<meta name="sap.whitelistService" content="url/to/whitelist/service" />
<script  id='sap-ui-bootstrap'
    src='resources/sap-ui-core.js'>
</script>