Menu
There is a web server running locally, and I want to have Keycloak (on another domain) login page inside the iframe. I tried the following setting in the Keycloak Real Settings > Security Defenses > Headers > Content-Security-Policy
frame-src 'self' http://127.0.0.1 http://192.168.1.140 http://localhost *.home-life.hub http://trex-macbook.home-life.hub localhost; frame-ancestors 'self'; object-src 'none';
Basically, I put my local IP addresses and host names as sources to frame-src.
The login page is not shown and I get this error in the browser console
Refused to display 'http://keycloak.example.com:8080/auth/realms/master/protocol/openid-connect/auth?client_id=es-openid&response_type=code&redirect_uri=https%3A%2F%2Fkibana.example.com%3A5601%2Fauth%2Fopenid%2Flogin&state=3RV-_nbW-RvmB8EfUwgkJq&scope=profile%20email%20openid' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".
My custom headers are present
My server and UI (server rendered) code:
'use strict';
const Hapi = require('@hapi/hapi');
const init = async () => {
// Run server on all interfaces
const server = Hapi.server({
port: 3000,
});
await server.start();
// server.ext('onPreResponse', (req, h) => {
// req.response.header('Content-Security-Policy', "default-src 'self' *.example.com");
// console.log('req.response.headers', req.response.headers);
// return h.continue;
// });
server.route({
method: 'GET',
path: '/home',
handler: () => {
return `<html>
<head>
<title>searchguard kibana openid keycloak</title>
</head>
<body>
<p>
<iframe src="https://kibana.example.com:5601" width="800" height="600"></iframe>
</p>
</body>
</html>`;
},
});
server.route({
method: '*',
path: '/{path*}',
handler: (req, h) => {
return h.redirect('/home');
},
});
console.log('Server running on %s', server.info.uri);
};
process.on('unhandledRejection', (err) => {
console.log(err);
process.exit(1);
});
init();
The iframe should show a page on kibana.example.com in the end. The Keycloak is used as an identity provider for the kibana.example.com.
235
Try to change:
frame-ancestors 'self';
to
frame-ancestors 'self' http://127.0.0.1 http://192.168.1.140 http://localhost *.home-life.hub http://trex-macbook.home-life.hub localhost;
Generally, tweak frame-ancestors CSP configuration.
60
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
