Invalid frame-ancestors CSP returned in federated document editing blocks Collabora iframe embedding

[Tenivar]

Steps to reproduce

1. Install two Nextcloud-aio instances on two different servers cloud.example1.com and cloud.example2.com, enabling Collabora on both instances. Both behind Apache2 reverse proxies ; both with Let's Encrypt certificates. Both are under rootless docker.
2. Set Collabora CSP through the options, using --o:net.content_security_policy="'self' https://cloud.example1.com https://cloud.example2.com;", on both servers.
3. Allow federated sharing, add each server to trusted servers on each instance.
4. Add both IP into allowed WOPI (IPV4+IPV6 in my case ; not sure this part is necessary)
5. Federated-share a document from example1 to example2.
6. Ty to edit from example2.

Expected behavior

The document should be opened and ready to edit.

Actual behavior

(tested on chromium, firefox, and on various computers. Error messages here are translated from french, sorry if not exact translations...)
The document fails to load, returning to "Firefox cannot open this page"; "To protect your security, cloud.example1.com will not allow Firefox to display the page if another site embeds it. To view this page, you must open it in a new window.".
Inspecting the network logs from the developer console, the request fails at the POST request :
https://cloud.example1.com/browser/REDACTED/cool.html?WOPISrc=https://cloud.example1.com/index.php/apps/richdocuments/wopi/files/REDACTED&lang=fr&closebutton=1&revisionhistory=1 with the error NS ERROR CSP FRAME ANCESTOR VIOLATION.
We have this error explanation :
Content-Security-Policy: The page settings prevented the loading of a resource (frame-ancestors) at address because it violates the following directive: “frame-ancestors https://cloud.axample1.com:*”.

In the header or the response, we have the following CSP :
content-security-policy media-src 'self' https://cloud.shanea.fr/; "'self' https://cloud.example1.com/ https://cloud.example2.com/; object-src 'self'; style-src 'self'; script-src 'self' 'unsafe-eval'; frame-ancestors cloud.example1.com:*; img-src 'self' data: https://www.collaboraoffice.com/ cloud.shanea.fr:*; connect-src 'self' https://www.zotero.org/ https://api.zotero.org/ wss://cloud.example1.com https://cloud.example1.com/; frame-src 'self' https://rating.collaboraonline.com/ https://rating.collaboraonline.com/ https://nextcloud.com/ blob:; font-src 'self'; default-src 'none';

Other information

Host OS

Debian Bookworm

Output of sudo docker info

Client: Docker Engine - Community
Version: 28.0.4
Context: default
Debug Mode: false
Plugins:
ai: Ask Gordon - Docker Agent (Docker Inc.)
Version: v0.7.3
Path: /usr/lib/docker/cli-plugins/docker-ai
buildx: Docker Buildx (Docker Inc.)
Version: v0.20.1-desktop.2
Path: /usr/lib/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v2.32.4-desktop.1
Path: /usr/lib/docker/cli-plugins/docker-compose
debug: Get a shell into any image or container (Docker Inc.)
Version: 0.0.38
Path: /usr/lib/docker/cli-plugins/docker-debug
desktop: Docker Desktop commands (Beta) (Docker Inc.)
Version: v0.1.4
Path: /usr/lib/docker/cli-plugins/docker-desktop
dev: Docker Dev Environments (Docker Inc.)
Version: v0.1.2
Path: /usr/lib/docker/cli-plugins/docker-dev
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.27
Path: /usr/lib/docker/cli-plugins/docker-extension
feedback: Provide feedback, right in your terminal! (Docker Inc.)
Version: v1.0.5
Path: /usr/lib/docker/cli-plugins/docker-feedback
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v1.4.0
Path: /usr/lib/docker/cli-plugins/docker-init
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /usr/lib/docker/cli-plugins/docker-sbom
scout: Docker Scout (Docker Inc.)
Version: v1.16.1
Path: /usr/lib/docker/cli-plugins/docker-scout

Server:
Containers: 18
Running: 15
Paused: 0
Stopped: 3
Images: 18
Server Version: 28.0.0
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: true
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
runc version: v1.2.5-0-g59923ef
init version: de40ad0
Security Options:
seccomp
Profile: builtin
rootless
cgroupns
Kernel Version: 6.1.0-30-amd64
Operating System: Debian GNU/Linux 12 (bookworm)
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 31.24GiB
Name: cloud
ID: 81a9cbe1-9f95-4e58-9aa6-b56e89120960
Docker Root Dir: /home/shanea_docker/.local/share/docker
Debug Mode: false
Experimental: false
Insecure Registries:
::1/128
127.0.0.0/8
Live Restore Enabled: false

WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support

Docker run command or docker-compose file that you used

Docker Compose file,
services:
nextcloud-aio-mastercontainer:
image: nextcloud/all-in-one:latest
init: true
restart: always
container_name: nextcloud-aio-mastercontainer
volumes:
- nextcloud_aio_mastercontainer:/mnt/docker-aio-config
- /run/user/1000/docker.sock:/var/run/docker.sock:ro 'WATCHTOWER_DOCKER_SOCKET_PATH'!
network_mode: bridge
ports:
#- 11000:80 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- 8080:8080
#- 8443:8443 # Can be removed when running behind a web server or reverse proxy (like Apache, Nginx, Caddy, Cloudflare Tunnel and else). See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
environment:
APACHE_PORT: 11000
APACHE_IP_BINDING: 0.0.0.0
COLLABORA_SECCOMP_DISABLED: false
NEXTCLOUD_DATADIR: /path/to/data/dir
NEXTCLOUD_UPLOAD_LIMIT: 16G
NEXTCLOUD_MEMORY_LIMIT: 1024M
NEXTCLOUD_ADDITIONAL_APKS: imagemagick
NEXTCLOUD_ADDITIONAL_PHP_EXTENSIONS: imagick
TALK_PORT: 11001
WATCHTOWER_DOCKER_SOCKET_PATH: /run/user/1000/docker.sock

volumes:
nextcloud_aio_mastercontainer:
name: nextcloud_aio_mastercontainer

Other valuable info

[szaimen]

Hi, please report this to https://github.com/nextcloud/richdocuments/issues. Thanks!

[ebildebil]

@Tenivar , did you manage to solve this? I have this issue as well.

I also wanted to ask, how/where do we set --o:net.content_security_policy="'self' https://cloud.example1.com https://cloud.example2.com;" in AIO?

[rallisf1]

I am too trying to figure out federated editing and can't make it work. On the remote NC it just says refused to connect. Any chance someone posts detailed steps?

I have tried:

• adding both servers' IPs to Allow list for WOPI requests
• adding --o:net.content_security_policy="frame-ancestors https://main.server.com https://remote.server.com;" to collabora's container extra_configenv variable. -- adding both server domains togs.trustedHostsinconfig.php`

P.S. I'm not really sure I need federated editing, can't any NC edit federated-shared files with its own collabora server?