Answer to the question: Analysis of the working principle of SAP UI5 application settings to prohibit being embedded and run by other applications. Trial version

The previous article of this tutorial answered the question raised by my friend on Knowledge Planetiframe : How to prevent the SAP UI5 application from being embedded into another front-end page and running settings:

• SAP UI5 application development tutorial one hundred and eighty - How to set a background image for a SAP UI5 application

That is, index.htmladd a line of code to the file of the SAP UI5 application:data-sap-ui-frameOptions='deny'

Later, a friend raised a question and pointed me to the following website:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

X-Frame-OptionsThis website mentioned that the way to avoid the risk of clickjacking is to set the value of in the HTTP response header field DENYto prevent the HTML page returned by the HTTP request from being embedded into other front-end pages and run:

However, in the example of the previous article in our tutorial, if we observe iframe2.htmlthe response header field of the returned HTTP request, we find that there is no X-Frame-Optionsfigure at all. So how does this example work?

This friend has very detailed observations, so the author of this article will take everyone together to find the answer to the question through single-step debugging.

The detailed answer is in this article .