Bug 213499

Summary:	Unable to see patch contents in Details iframe due to X-Frame-Options: SAMEORIGIN
Product:	Services	Reporter:	VK <vlad-fbsd>
Component:	Bug Tracker	Assignee:	Peter Wemm <peter>
Status:	Closed FIXED
Severity:	Affects Many People	CC:	bugmeister, clusteradm, mmokhi, peter
Priority:	---	Keywords:	feature, regression
Version:	unspecified
Hardware:	Any
OS:	Any

Description VK 2016-10-15 08:37:14 UTC

Responses from domain FreeBSD Bugzilla domains include X-Frame-Options header set to SAMEORIGIN which effectively prevents Attachment Details from using the iframe on bugs.freebsd.org to load and show attachment contents from bz-attachments.freebsd.org.

Solution: set X-Frame-Options: ALLOW-FROM https://bugs.freebsd.org on responses from bz-attachments.freebsd.org. Also header 'Content-Security-Policy: frame-ancestors' for the Chromium family of browsers.

Marking regression because this used to work.

Comment 1 Peter Wemm freebsd_committer

2016-11-13 17:15:31 UTC

Thanks for the report, I'll look into this right away.

Comment 2 Peter Wemm freebsd_committer

2016-11-13 17:31:58 UTC

Setting the ALLOW-FROM does appear to make both Firefox and Chrome show the contents when clicking the 'Details' button.  Can you confirm that basic functionality is restored?

We don't set a CSP on either of those addresses.  Chrome's console is quite angry about the state of things but appears to "work" in spite of it.  Clearly there's more work required there - it is complaining about allow-scripts as well.

I'll leave this marked as in-progress and look at it more today.

Comment 3 VK 2016-11-13 17:45:04 UTC

Yes I can confirm, both Chromium and Firefox now show attachment contents.

It appears that Content-Security-Policy is now preferred over X-Frame-Options when an "allow" policy is to be set:

https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy

That, instead of X-Frame-Options should keep the intended protection in both browsers and quiet the Chromium console. Right now it "works" in Chromium in that there's no understood policy, so it's implicitly allowed.

Comment 4 VK 2017-01-02 22:00:05 UTC

Is there anything else to be done with this? I see it's working just fine since it was fixed back in November.

Comment 5 Mahdi Mokhtari freebsd_committer

2017-01-02 22:07:07 UTC

(In reply to Vladimir Krstulja from comment #4)
I guess it's done.
need peter@ to confirm it though :D

Comment 6 VK 2017-06-30 22:23:13 UTC

Peter, can we close this? Seems everything is working just fine.

Comment 7 Peter Wemm freebsd_committer

2017-07-20 00:42:50 UTC

I believe that this can be closed.