title: Is there any way to circumvent X-frame-options sameorigin?
body: <p>Is it possible to write a webapp, that can display third-party webpages without having to act as a proxy?</p>
  
  <p>This comes up because I've seen services like comic-rocket.com* harmed by <code>X-frame-options: sameorigin</code>. While I perfectly understand, that this is an important security feature to prevent click-jacking, it also means, that webapps have lost a potentially important capability compared to native applications.</p>
  
  <p>Using the server of the service as a proxy would certainly be a solution, but would significantly ramp up data usage, as all resources would have to be redirected through the proxy as well to prevent same-origin issues on embedded resources. Furthermore, websites may block such behaviour. Legal implications are unclear too. A server-side solution is thus probably unviable.</p>
  
  <p>So I was wondering: Is there any method to obtain permission from the user to ignore X-frame-options? Would it be possible with PWAs?</p>
  
  <hr>
  
  <p>* Not affiliated. I am merely a user of the service, but interested in what I may suggest to them as a solution, or what I may even be able to do on my side with bookmarklets / Tampermonkey.</p>
  
  <p>As a little historical note, previously webpages now affected by the X-frame-options setting used to redirect the toplevel frame to themselves, which in the case of comic-rocket.com ultimately affected the user-experience less. Sadly, the ability of redirecting toplevel URLs has become a big issue with malicious ads, and apparently has also been blocked. </p>