I want to add iframe in my app,but was rejected

Forge
1

1
11492×52 4.33 KB

2
2923×690 18 KB

2

Hi @Mockplus,

It looks like your Server is returning a CSP header that does not permit the browser to display your page as an iframe. You need to correctly set the frame-src value of your Content-Security-Policy header.

Cheers,
Sven

3

hello Sven, Thank you very much for your answer.

I built an app with forge.I want to use iframe to embed my own website. then,prompt me the error in the first picture above,should I make relevant CSP settings on my own website?

1 Like
4

Sorry, I was completely oblivious to the fact that you’re doing this in Forge!

In that case you’d of course need some way to set this in Forge but it looks like you can currently only control the CSP for images and styles. Hopefully someone from Atlassian will chime in to tell us whether they’re working on providing us further control over the Custom UI CSP values.

Cheers,
Sven

2 Likes
5

Anyway, thank you very much, and hope that someone from Atlassian will pay attention to my question.

6

@Mockplus - welcome, glad you made the jump from Atlassian Community to Atlassian Developer Community!

7

Hi @Mockplus ,

Currently, there’s no way to specify iframes and have them bypass the Forge Content Security Policies.

What use case are you trying to achieve? One alternative would be to specify your domains inside client permissions. This gives you the ability to make a window.fetch call to the site, and you can embed or display the HTML response.