Can you please if you getting this error in your console request is blocked because it violates the following Content Security Policy directive: “default-src ‘self’”. Note that ‘frame-src’ was not explicitly set, so ‘default-src’ is used as a fallback”
Which was enough to dig-down the actual problem. The solution is to make sure your “Content-Security-Policy” is correctly configured to be able to load this IFrame
into Sitecore.
Luckily, Sitecore has a configuration to handle your different custom headers. You just need to open web.config
and search for customHeaders
section.
<location path="sitecore">
<system.webServer>
<httpProtocol>
<customHeaders>
<remove name="X-Content-Type-Options" />
<remove name="X-XSS-Protection" />
<remove name="Content-Security-Policy" />
<add name="X-XSS-Protection" value="1; mode=block" />
<add name="X-Content-Type-Options" value="nosniff " />
<add name="Content-Security-Policy" value="default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; block-all-mixed-content;" />
</customHeaders>
</httpProtocol>
You can try this.
Hope this helps.