[bug] Not able to use filestash inside iframe

[alanmilinovic]

Description of the bug

Tried to include it in Home assistant but getting error. Refused to frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors.

Step by step instructions to reproduce the bug

Simply try to use it in any iframe html element.

Can you replicate that error from the demo?

Cannot be tested as demo is working over https, that is a different behaviour and problem.

Observed behavior

Framing filestash in iframe should be allowed in my opinion.

[mickael-kerjean]

Iframe is blocked by default because it would open your instance to clickjacking attacks. That's the reason this exists: essentially you need to opt in to iframe to avoid the security issue and that's how it was setup on the main website

[alanmilinovic]

When I use domain with port it is working. But when I use ip with the port I get dead screen with cat.

[alanmilinovic]

Also login is not working (not Authorised) once I add domains. It doesn't matter if I try within iframe or direct url, as soon as iframe property is filed, login stop working.

[alanmilinovic]

Any idea what could be wrong? Do you have enough information for testing?

[alanmilinovic]

Is this planned to be fixed in near future?

[alanmilinovic]

Any news?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.