How could I enable access to my site from any iframe including from a local html file?
critical58 opened this issue · comments
For instance, would it be possible to allow anyone to make an html file and run it locally and use my site through an iframe on that file, as this currently works without attempt to solve the issue apart from that I am unable to use response.redirect(). Thanks in advance!
By default, Helmet prevents others from putting your pages in iframes.
You can fix this by (1) removing the X-Frame-Options header (2) removing the frame-ancestors directive from the Content-Security-Policy middleware.
For example:
app.use(
helmet({
contentSecurityPolicy: {
directives: {
// ...
"frame-ancestors": null,
},
},
frameguard: false,
})
);Does this answer your question?
Hi,
Refused to frame 'https://example.website.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors *". Note that '*' matches only URLs with network schemes ('http', 'https', 'ws', 'wss'), or URLs whose scheme matches self's scheme. The scheme 'https:' must be added explicitly. is the error I am getting right now. Thank you for looking into it !
It looks like the Content-Security-Policy header on https://example.website.com/ is blocking it. Can you configure that header?
Sorry I left some previous code in from earlier haha! This allows me to view the iframe but when response.redirect() is called the redirect doesnt happen and the page is refreshed. I am getting this in the console. Indicate whether a cookie is intended to be set in a cross-site context by specifying its SameSite attribute. When I submit the form outside of the iframe to call the redirect it works as intended so im unsure what the issue is. I am also not able to fetch from font awesome with this config. Thanks!
Hi, before I do this I was wondering how I could implement this Because a cookie’s SameSite attribute was not set or is invalid, it defaults to SameSite=Lax, which prevents the cookie from being sent in a cross-site request. This behavior protects user data from accidentally leaking to third parties and cross-site request forgery. Resolve this issue by updating the attributes of the cookie: Specify SameSite=None and Secure if the cookie should be sent in cross-site requests. This enables third-party use. Specify SameSite=Strict or SameSite=Lax if the cookie should not be sent in cross-site requests. as this sounds like the problem. Is this possible in helmet or is this an issue not to do with helmet? Many thanks!
Not sure, but I suspect this is an issue with how cookies are set. Helmet doesn't do much with cookies, so I expect the problem is elsewhere.
It's been two weeks since any activity on this issue, so I'm going to close. Let me know if that's wrong.