Maybe you can use the widget mechanism. Go to your portlet, open configuration and go to Sharing -> Any website. There is a javascript that should be put on the other website (but I think you can try to use provided url in iframe on destination system). Personally I haven't used this solution in production (but I always wanted to try 
), we have done once an "iframe integration" but that was simply a page with blank theme containing our portlet.
Regards,
KG
), we have done once an "iframe integration" but that was simply a page with blank theme containing our portlet.Regards,
KG
Krzysztof Gołębiowski:
Maybe you can use the widget mechanism. Go to your portlet, open configuration and go to Sharing -> Any website. There is a javascript that should be put on the other website (but I think you can try to use provided url in iframe on destination system). Personally I haven't used this solution in production (but I always wanted to try
Regards,
KG
This sounds like the perfect solution for me.
I gave it a little try. From my site (which still is localhost only) I copied the script my portlets configuration presented for sharing:
<script src="http://localhost:8080/html/js/liferay/widget.js" type="text/javascript"></script>
<script type="text/javascript">
Liferay.Widget({ url: 'http://localhost:8080/widget/web/guest/admin/-/AdHgAdmin_WAR_AdHgAdmin10SNAPSHOT'});
</script>For a simple test I created a test.html file and copied this code inside standard html, body tag.
<h1>Test</h1> <script src="http://localhost:8080/html/js/liferay/widget.js" type="text/javascript"></script> <script type="text/javascript"> Liferay.Widget({ url: 'http://localhost:8080/widget/web/guest/admin/-/AdHgAdmin_WAR_AdHgAdmin10SNAPSHOT'}); </script>
End
Then I opened this with my web browser. My hope was that the portlet should be loaded with this html page. Since it's all javascript client code.
"Test" and "End" was shown with a number of blank row in between, but no portlet data.
Perhaps it's not possible to test shareing in this way. Do I need to put this code on a server of some sort?
I tested this code and in fact it does not work 
(but I think it used to work in the past).
When I run this code, browser console displays the following error:
I read that X-Frame-Options was introduced recently (2010/11) to prevent vulnerabilities that were caused by "iframing" content. Basically option SAMEORIGIN says that this content can be iframed only on a website with the same domain as origin (http://tools.ietf.org/html/rfc7034#section-2.1). I tested this and put this snippet under the same domain - IFrame with my portlet has been loaded without any problems.
I think this may be and old functionality in Liferay, possibly it was introduced before X-Frame-Options header and it has not been adapted yet (and at the same time, Tomcat/Liferay automatically appends this header to all requests preventing all iframe vulnerabilities). Anyway, I've seen this is managed by separate servlet com.liferay.portal.servlet.WidgetServlet so I think it should be easy to override with ext or servlet filter hook.
I tested this on Liferay 6.2, maybe older versions behave in different way.
Regards,
KG
(but I think it used to work in the past). When I run this code, browser console displays the following error:
Refused to display 'http://host/widget/web/guest/home/-/56_INSTANCE_TtFG4Bd9fkkh' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.I read that X-Frame-Options was introduced recently (2010/11) to prevent vulnerabilities that were caused by "iframing" content. Basically option SAMEORIGIN says that this content can be iframed only on a website with the same domain as origin (http://tools.ietf.org/html/rfc7034#section-2.1). I tested this and put this snippet under the same domain - IFrame with my portlet has been loaded without any problems.
I think this may be and old functionality in Liferay, possibly it was introduced before X-Frame-Options header and it has not been adapted yet (and at the same time, Tomcat/Liferay automatically appends this header to all requests preventing all iframe vulnerabilities). Anyway, I've seen this is managed by separate servlet com.liferay.portal.servlet.WidgetServlet so I think it should be easy to override with ext or servlet filter hook.
I tested this on Liferay 6.2, maybe older versions behave in different way.
Regards,
KG
