Error when trying to edit templates (Refusing to display in an iframe)
When I go into the backoffice and try to access a template, it never comes up. When I view the console, I see an error like this:
Refused to display 'https://www.sctflash.com/umbraco/settings/Views/EditView.aspx?treeType=templates&templateID=5082' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".
This only happens on production, not on my stage server or localhost.
I deleted the app_data folder to see if it would fix it but it did not.
I noticed when I look edit the template on my production site, it is like this, the response headers are these:
Error when trying to edit templates (Refusing to display in an iframe)
When I go into the backoffice and try to access a template, it never comes up. When I view the console, I see an error like this:
Refused to display 'https://www.sctflash.com/umbraco/settings/Views/EditView.aspx?treeType=templates&templateID=5082' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".
This only happens on production, not on my stage server or localhost.
I deleted the app_data folder to see if it would fix it but it did not.
I noticed when I look edit the template on my production site, it is like this, the response headers are these:
Access-Control-Allow-Headers:Content-Type Access-Control-Allow-Methods:GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin:* Cache-Control:no-cache Content-Length:41216 Content-Security-Policy:frame-ancestors 'none' Content-Type:text/html; charset=utf-8 Date:Wed, 24 Aug 2016 15:17:44 GMT Expires:-1 Pragma:no-cache Strict-Transport-Security:max-age=15552001; includeSubDomains; preload X-Frame-Options:DENY
but on stage it is:
Access-Control-Allow-Headers:Content-Type Access-Control-Allow-Methods:GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Origin:* Cache-Control:no-cache Content-Length:42090 Content-Type:text/html; charset=utf-8 Date:Wed, 24 Aug 2016 15:31:22 GMT Expires:-1 Pragma:no-cache
Thanks, Saied
In case anyone runs into this,
I found the solution here:
https://cultiv.nl/blog/so-you-want-to-secure-your-umbraco-site/
Basically, I just needed to make the backoffice an exception to the security headers being sent
is working on a reply...
This forum is in read-only mode while we transition to the new forum.
You can continue this topic on the new forum by tapping the "Continue discussion" link below.