remove "x-frame-options" and "content-security-policy" response headers#2963
remove "x-frame-options" and "content-security-policy" response headers#2963rejas merged 2 commits intoMagicMirrorOrg:developfrom
Conversation
…onses if configured; these headers prevent sites of being embedded into iframes; with the headers being removed the sites can be embedded;
Codecov Report
@@ Coverage Diff @@
## develop #2963 +/- ##
===========================================
+ Coverage 24.00% 24.08% +0.07%
===========================================
Files 49 49
Lines 10121 10135 +14
===========================================
+ Hits 2430 2441 +11
- Misses 7691 7694 +3
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
|
interesting. but doesn't that violate the source's content policies? |
|
It might violate but it it does not necessarily. In my case even my self hosted Node Red dashboard has set the header and I did not find a option to disable it. |
|
if I remember this correctly we had already such issues and we inserted a config option Have you tested iframe embedding with these let config = {
address: "localhost",
port: 8080,
httpHeaders: { contentSecurityPolicy: false, crossOriginOpenerPolicy: false, crossOriginEmbedderPolicy: false, crossOriginResourcePolicy: false, originAgentCluster: false, frameguard: false },
...
}
|
|
Did a quick check in server.js and the Changelog. |
|
thanks for clarifying, had the older iframe change in mind and wanted to avoid doing something which is already implemented. |
|
Thank you very much. |
5 participants
Many users like me do have the problem that they want to embed other sites to their mirror by "iframe".
As some developers set the "x-frame-options" and "content-security-policy" for security reasons these sites can not be embedded.
Electron provides the "webview" element additionally to "iframe" which allows to embed these sites although. The main difference is that a new process is started which handles the "webview" element.
BUT: As the "webview" process needs to be started and is isolated "webview" is slower and the elements can not be accessed from the embedding website.
As an alternative i implemented a small callback function in electron.js which removes the response headers that forbid the embedding.
The removing can be controlled with the new config options: