Contrib.social

Clickjacking CSS protection hides content when site is embed inside an iframe, even if frame-ancestors is set

Open on Drupal.org →
Created on 14 January 2024, about 1 year ago

Problem/Motivation

I have a Drupal site with a URL that needs to be embedded in an external site. After configuring frame-ancestors correctly the site is still not properly displayed because the hijacking protection sets the site content as hidden using CSS with important.

Steps to reproduce

You need to have sites a and b, both of them in different domains. Using ddev for both works, with URLS a.ddev.site and b.ddev.site as example.

  • In site "a" configure seckit properly, with frame-ancestors like "'self' b.ddev.site". Make sure that Clickjacking -> Javascript-based protection is checked.
  • In site "b" configure seckit properly, to allow embedding urls from "a" as an iframe, with the frame-src adding a.ddev.site
  • In site "b" create an iframe pointing to an url of "a", like https://a.ddev.site/node/1. Navigate to the URL and see two things:

Proposed resolution

The solution that we proposed and works for us is injecting the whitelisted urls from frame-ancestors in the seckit.document_write.js to check url from the parent page with those, and in this case avoid adding the seckit.no_body.css file that hides the content.

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

🇪🇸Spain jsbalsera Córdoba, Spain

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024