managed getting this to work by adding the frameguard option, see below git diff.

This will decrease security again but the whole app is so insecure ... I can provide a PR if wished, may with a config option so this is not allowed by default.

magic_mirror on  develop [✘!?] is 📦 v2.20.0-develop via  v18.1.0 took 6s
⬢ [Docker] ❯ git diff js/server.js
diff --git a/js/server.js b/js/server.js
index 7a298cd..09fc338 100644
--- a/js/server.js
+++ b/js/server.js
@@ -69,7 +69,7 @@ function Server(config, callback) {
                        res.status(403).send("This device is not allowed to access your mirror. <br> Please check your config.js or config.js.sample to change this.");
                });
        });
-       app.use(helmet({ contentSecurityPolicy: false, crossOriginOpenerPolicy: false, crossOriginEmbedderPolicy: false, crossOriginResourcePolicy: false, originAgentCluster: false }));
+       app.use(helmet({ contentSecurityPolicy: false, crossOriginOpenerPolicy: false, crossOriginEmbedderPolicy: false, crossOriginResourcePolicy: false, originAgentCluster: false, frameg
uard: false }));

        app.use("/js", express.static(__dirname));

Uh oh!

Embedding in another Website #2847

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions