Getting "Load denied by X-Frame-Options" JS error

Having the same problem on one of my sites...

Well, the initial report was a while ago. I encountered this issue after updating core to 7.50. This release introduced the X-Frame-Options header: https://www.drupal.org/node/2735873

You can solve this temporarily by adding this to your settings.php:

$conf['x_frame_options'] = '';

But adding this header was a security hardening and shouldn't be removed. I guess the issue is that the media browser iframe is loaded relatively:

<iframe src="/media/browser?render=media-popup"></iframe>

Using a absolute URL would solve this I guess.

Have the same issue which is weird. The URL is set in media_browser_js(); function and it's indeed relative. Is there any way to make it absolute?

Lot changes have been committed to the module. Does anyone seeing this have to time to re-test?

I just tested this on another site and I still have this issue with RC12 on 7.52. Setting x_frame_options fixed the issue again.

Ok, the issue I have is caused by the x_frame_options I had before:

<?php
$conf['x_frame_options'] = 'ALLOW-FROM https://www.example.com/';
?>

Removing this and using the default value "SAMEORIGIN" sovles this issue.

Also worth noting is that this issue is present on Firefox but not on Chrome. Chrome probably already ignores X-Frame-Options.

I am still experiencing this issue, but as #6 said, only in Firefox.

In 7.x-3.x there is a patch that has code that could be repurposed for this

#1352182: Media assets should have relative paths for wysiwyg editors

allows optional setting
media_browser_relative_url
by default this variable is set to FALSE , this way items get full url for files but we'd have to purpose this for the media browser iframe

this method could be adopted to put the full path for the media browser iframe

the media browser code in question is:

line 426 media.module

/**
 * Submit handler; direction form submissions in the media browser.
 */
function media_browser_form_submit($form, &$form_state) {
  $url = NULL;
  $parameters = array();

  // Single upload.
  if (!empty($form_state['file'])) {
    $file = $form_state['file'];
    $url = 'media/browser';
    $parameters = array('query' => array('render' => 'media-popup', 'fid' => $file->fid));
  }

line 491 media.module

   'browserUrl' => url('media/browser', array(

where there is a will, there is a way.

#1990864-6: Getting "Load denied by X-Frame-Options" JS error #6 worked for me. Thanks.

And to be explicit, what Luks meant is:

<?php
$conf['x_frame_options'] = 'SAMEORIGIN';
?>