Copied to clipboard

Flag this post as spam?

This post will be reported to the moderators as potential spam to be looked at


  • Saied 349 posts 674 karma points
    Aug 24, 2016 @ 15:22
    Saied
    0

    Error when trying to edit templates (Refusing to display in an iframe)

    When I go into the backoffice and try to access a template, it never comes up. When I view the console, I see an error like this:

    Refused to display 'https://www.sctflash.com/umbraco/settings/Views/EditView.aspx?treeType=templates&templateID=5082' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".

    This only happens on production, not on my stage server or localhost.

    I deleted the app_data folder to see if it would fix it but it did not.

    I noticed when I look edit the template on my production site, it is like this, the response headers are these:

    Access-Control-Allow-Headers:Content-Type Access-Control-Allow-Methods:GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin:* Cache-Control:no-cache Content-Length:41216 Content-Security-Policy:frame-ancestors 'none' Content-Type:text/html; charset=utf-8 Date:Wed, 24 Aug 2016 15:17:44 GMT Expires:-1 Pragma:no-cache Strict-Transport-Security:max-age=15552001; includeSubDomains; preload X-Frame-Options:DENY

    but on stage it is:

    Access-Control-Allow-Headers:Content-Type Access-Control-Allow-Methods:GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin:* Cache-Control:no-cache Content-Length:42090 Content-Type:text/html; charset=utf-8 Date:Wed, 24 Aug 2016 15:31:22 GMT Expires:-1 Pragma:no-cache

    Thanks, Saied

  • Saied 349 posts 674 karma points
    Aug 24, 2016 @ 18:13
    Saied
    0

    In case anyone runs into this,

    I found the solution here:

    https://cultiv.nl/blog/so-you-want-to-secure-your-umbraco-site/

    Basically, I just needed to make the backoffice an exception to the security headers being sent

Please Sign in or register to post replies

Write your reply to:

Draft