Imagine a scenario, where the main website is served at https://example.com, and the iFrame domain options is set to an alias; https://oembed.example.com
This way when media on a page is viewed, the markup on https://example.com would be something like:
<iframe src="https://oembed.example.com/media/oembed?url=https%3A//youtu.be/Dc3LpT69crc&max_width=0&max_height=0&hash=J3reigEh1oul-MNqUBBvVbfHUo1eI54gZryZJT22g1E" frameborder="0" allowtransparency width="480" height="270" class="media-oembed-content"></iframe>
Out-of the box, this fails with an error:
Refused to display 'https://oembed.example.com/media/oembed?url=https%3A//youtu.be/Dc3LpT69c...' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
Unless an appropriate X-Frame-Options header is set, the iframe content will not load.
Should this be an optional setting, addition to iFrame domain in Media settings > Security?
$form['security']['x_frame_options'] = [
'#type' => 'checkbox',
'#title' => $this->t('Set HTTP header: X-Frame-Options: allow-from {IFRAME_DOMAIN}'),
'#default_value' => $this->config('media.settings')->get('x_frame_options'),
'#description' => $this->t('If the content served from iFrame domain is not displayed try enabling this option.'),
'#states' => [
'invisible' => [
':input[name="iframe_domain"]' => ['empty' => TRUE],
],
],
];
Then set the HTTP header in an EventSubscriber:
public function onKernelResponse(FilterResponseEvent $event) {
$iframe_domain = $this->config->get('iframe_domain', '');
$x_frame_options = $this->config->get('x_frame_options', 0);
if ($iframe_domain !== '' && (bool) $x_frame_options) {
$response = $event->getResponse();
$response->headers->set('X-Frame-Options', "allow-from ${iframe_domain}");
}
}
Needs work
11.0 🔥
Last updated
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.
Issue summaries save everyone time if they are kept up-to-date. See Update issue summary task instructions.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
Can the issue summary be updated please to match standard issue template.