X frame bypass

Web Component extending IFrame to bypass X-Frame-Options: deny/sameorigin

From niutech·Updated June 12, 2026·View on GitHub·

X-Frame-Bypass is a [Web Component](https://www.webcomponents.org/introduction), specifically a [Customized Built-in Element](https://html.spec.whatwg.org/multipage/custom-elements.html#custom-elements-customized-builtin-example), which extends an IFrame to bypass the [`X-Frame-Options: deny/sameorigin`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) response header. Normally such headers prevent embedding a web page in an `` element, but X-Frame-Bypass is using a COR... The project is written primarily in JavaScript, distributed under the Apache License 2.0 license, first published in 2019. Key topics include: custom-element, iframe, web-component, x-frame-options.

X-Frame-Bypass

X-Frame-Bypass is a Web Component, specifically a Customized Built-in Element, which extends an IFrame to bypass the X-Frame-Options: deny/sameorigin response header. Normally such headers prevent embedding a web page in an <iframe> element, but X-Frame-Bypass is using a CORS proxy to allow this.

Usage

(Optional) Include the Custom Elements with Built-in Extends polyfill for Safari:
```
 <script src="https://unpkg.com/@ungap/custom-elements-builtin"></script>
```

Include the X-Frame-Bypass JS module:

 <script type="module" src="https://unpkg.com/x-frame-bypass"></script>

Insert the X-Frame-Bypass Custom Element:

 <iframe is="x-frame-bypass" src="https://example.org/"></iframe>

Demo

See the Hacker News using X-Frame-Bypass. Supported are current versions of Chrome and Firefox browsers. Edge and Safari do not support Customized Built-in Elements yet.