Iframe 8.11.0 not sending back information

Questions
1

Hello.

I have a rather open-ended question.

  • Do we know of any changes between 8.3.0 and 8.11.0 that would cause an iframe not to send data back to the application?

I have an iframe that worked well before but stopped working after I did an upgrade.

Any tips would be helpful.

2

Is the iframe on the same domain as it is included in?

The UseLitiumXFrameOptions middleware was added to add extra security and prohibit that the website can be included in another site (preventing click bait attack). That have the impact that if your iframe need to be loaded from another site the middlewere need to be excluded for that path, you will do that in the startup.cs file with something like below

change from

app.UseLitiumXFrameOptions();

to something like this

app.UseWhen(x => !x.Request.Path.StartsWithSegments("/myUrl"), x => x.UseLitiumXFrameOptions());

where the myUrl is the url that you want to exclude from this middleware

1 Like
3

The iframe content and the website are on from two different domains but the content is always served from the same domain.

We didn’t have UseLitiumXFrameOptions to begin with.
We tried to add it but then it hindered us from moving forward.

The error we got: InvalidOperationException: No service for type ‘Litium.Web.Runtime.XFrameOptions.XFrameOptionsMiddleware’ has been registered.

4

most probably the

services.AddLitiumXFrameOptions();

was not added in the ConfigureServices-method inside the startup.cs file.

but if that not is added it should not be the problem if that not is added in some other way or similar header that prohibit cross-domain iframe request.

What does the network console provide for information? Can you see the request for the iframe content url and what is the response back there?

1 Like
5

We thought so as well.

The iframe we have is visible and we can interact with, all except one button. This one button is meant to take us to the checkout page.

When clicking on this one button we do not get anything, no errors and nothing in the network. Nothing locally and nothing in our test environment. When using

monitorEvents(window, “message”)

in the console browser we can see this message, the information stored on it, when we press the button. But nothing ever happens. This wasn’t a problem until the project got upgraded.

So that’s why I thought that maybe something had happened to the iframe during the upgrade. But now it seems that it isn’t the case.

6

Okay so it seems like it might’ve been a link issue.

The link we used had /test/ in it. We have contact with the provider but you would think that we would have been told if something was wrong with the test link.

When we changed from the test link to the normal link used in production it work. It works locally and on our test site.

7

Can it be that the iframe response have some CSP (Content Security Policy) that will prohibit the button event on the url that you was testing from?

8

The Content Security Policy seems to be identical in both test and production currently. :slight_smile:

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.