The rich text block iframe in Editor mode

Question

I have added this iframe in Sitecore RTE field

<iframe class="EurolandTool" src="https://tools.eurolandir.com/tools/FinCalendar2/?companycode=ae-nbad&v=ae-nbad_redesign2017&lang=en-gb" width="100%" height="500" scrolling="no" frameborder="0"></iframe>

but it is blocked in editor mode. Do you have an idea about the problem?

Answer 1

IFrame source will be blocked by Content Security Policy. Update you CM web.config Content-Security-Policy by adding desired Url. See below for tested example on Sitecore 10.0.1:

<location path="sitecore">
        <system.webServer>
            <httpProtocol>
                <customHeaders>
                    <remove name="X-Content-Type-Options" />
                    <remove name="X-XSS-Protection" />
                    <remove name="Content-Security-Policy" />
                    <add name="X-XSS-Protection" value="1; mode=block" />
                    <add name="X-Content-Type-Options" value="nosniff " />
                    <add name="Content-Security-Policy" value="default-src 'self' https://tools.eurolandir.com 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; block-all-mixed-content;" />
                </customHeaders>
            </httpProtocol>
        </system.webServer>
    </location>

Answer 2

Can you please if you getting this error in your console request is blocked because it violates the following Content Security Policy directive: “default-src ‘self’”. Note that ‘frame-src’ was not explicitly set, so ‘default-src’ is used as a fallback”

Which was enough to dig-down the actual problem. The solution is to make sure your “Content-Security-Policy” is correctly configured to be able to load this IFrame into Sitecore.

Luckily, Sitecore has a configuration to handle your different custom headers. You just need to open web.config and search for customHeaders section.

 <location path="sitecore">
    <system.webServer>
      <httpProtocol>
        <customHeaders>
          <remove name="X-Content-Type-Options" />
          <remove name="X-XSS-Protection" />
          <remove name="Content-Security-Policy" />
          <add name="X-XSS-Protection" value="1; mode=block" />
          <add name="X-Content-Type-Options" value="nosniff " />
          <add name="Content-Security-Policy" value="default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; block-all-mixed-content;" />
        </customHeaders>
      </httpProtocol>

You can try this.

Hope this helps.