Questions about Inline frame

Ignition
1

Hi everyone, I'm having problems with Inline Frame, I've looked through the forums and haven't found anyone sharing a similar problem to mine.

I put a frontend interface A on Inline Frame, after saving the project and opening it in a browser, it shows the login page for A. After entering my password and clicking login, I can't jump to the homepage of A. I'm having trouble with this.

I checked the developer platform of the browser and the interface to verify the password is triggered successfully after clicking the login button.

What should I do next to troubleshoot the next problem, I have no clue, what I can confirm is that X-Frame-Options is not set to be disabled on A's system.

3

Maybe there's something wrong with my statement that System A doesn't use X-Frame-Options, so his login page can be displayed normally instead of showing refused to connect. and I do see in the developer tool of my browser that this is not used.

I think it should be something else.

4

OK. I misunderstood. I'll delete my previous post as it's not relevant.

5

X-Frame-Options must be affirmatively set to to allow IFrame usage. Missing the option is equivalent to disallowing IFrames, IIRC.

6

I just added it, but it still doesn't jump from the login page to the home page

img_v3_02f2_8d50fb63-053f-4694-a7db-3c60eec9a3cg
img_v3_02f2_8d50fb63-053f-4694-a7db-3c60eec9a3cg742×336 86.6 KB

7

"Same Origin" means the IFrame must be delivered by the same server to be allowed. That is the default that prevents other servers from embedding the content in their IFrame.

8

Sorry I didn't understand carefully, so how do I change this configuration please.

Someone just told me that it's because the token is not being passed, but I don't know if it is, do you understand what it means?

9

See the docs here:

You need the "Allow-From ..." syntax that explicitly identifies the system that will wrap around the IFrame. But note the compatibility warning that recommends using Content-Security-Policy.

10

Allow all is the default if nothing is filled in normally.
So that was not what the initial problem was