The loading of "URL" in a frame is denied by "X-Frame-Options" directive set to "deny"

[karelvrabeckv]

Hello,
We are trying to deploy our newly created Trame application on our servers (without the use of CapRover).

However, we are getting the following error (due to the security policy):
Refused to display "URL" in a frame because it set "X-Frame-Options" to "deny".

How are we supposed to solve this, please?
Is it possible to somehow get rid of <iframe> under the hood in Trame?

Thank you very much! :)

[jourdain]

Seems to be a setup on your server based on a quick google search. Since I don't know anything about your setup, it is hard to help.

[lahwaacz]

Yes, it is related to the server configuration (I'm the one deploying the app). The server has add_header X-Frame-Options DENY; on the top level and it is not easy to override this in a specific location block in nginx. Also note that I would have to add a new location block for the /loading/index.html endpoint if I wanted to keep the default security policy for the whole application.

So the problem is that /loading/index.html requires at least X-Frame-Options SAMEORIGIN because the loading page is loaded through an iframe. This does not make it easy to deploy in some scenarios. Why do you need iframe and can't render the loading page by other means, such as dynamic DOM manipulations as usual?

[lahwaacz]

The websocket error was an unrelated configuration issue that I just fixed.

[jourdain]

Ok, it start making sense now, thanks for providing additional context.

So the first/easy solution for the loading screen to skip the iframe would be to use trame-client<=2.15.0.

While it would be nice to figure out a better solution long term, let me explain why the loading is now in an iframe. The idea of that iframe is to allow user to be able to easily override the default screen with their own and the iframe path provide a nice code split.

If you have any suggestion or idea on how to better support such use-case, I will be glad to hear it.

[lahwaacz]

Ok that worked, thanks. Would be nice if you can make the iframe approach configurable, even at build time.

[jourdain]

I will need to think on how to actually enable that.

Is there an easy setup for me to try having a add_header X-Frame-Options DENY; for debugging purpose locally? I can search but if you have a simple path to try out, that would be easier...

[lahwaacz]

I don't have anything easy to share, but if you get e.g. a docker image with nginx deployment of some app, you can just add add_header X-Frame-Options DENY; in the http {...} block or server {...} block in nginx.conf.

[jourdain]

Should now be fixed in trame-client>=2.16.4

[lahwaacz]

Thank you, that was fast! This issue can be closed then.

[jourdain]

Since it is a discussion, leaving it open but just tagged it as answered. ;-)