0

I have added this iframe in Sitecore RTE field

<iframe class="EurolandTool" src="https://tools.eurolandir.com/tools/FinCalendar2/?companycode=ae-nbad&v=ae-nbad_redesign2017&lang=en-gb" width="100%" height="500" scrolling="no" frameborder="0"></iframe>

but it is blocked in editor mode. Do you have an idea about the problem?

enter image description here

1
  • Which Sitecore version? You might need to add update content security policy in CM web.config. Check for console error too.
    – Kamil C
    Jan 31, 2023 at 10:24

2 Answers 2

0

IFrame source will be blocked by Content Security Policy. Update you CM web.config Content-Security-Policy by adding desired Url. See below for tested example on Sitecore 10.0.1:

<location path="sitecore">
        <system.webServer>
            <httpProtocol>
                <customHeaders>
                    <remove name="X-Content-Type-Options" />
                    <remove name="X-XSS-Protection" />
                    <remove name="Content-Security-Policy" />
                    <add name="X-XSS-Protection" value="1; mode=block" />
                    <add name="X-Content-Type-Options" value="nosniff " />
                    <add name="Content-Security-Policy" value="default-src 'self' https://tools.eurolandir.com 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; block-all-mixed-content;" />
                </customHeaders>
            </httpProtocol>
        </system.webServer>
    </location>
1

Can you please if you getting this error in your console request is blocked because it violates the following Content Security Policy directive: “default-src ‘self’”. Note that ‘frame-src’ was not explicitly set, so ‘default-src’ is used as a fallback”

Which was enough to dig-down the actual problem. The solution is to make sure your “Content-Security-Policy” is correctly configured to be able to load this IFrame into Sitecore.

Luckily, Sitecore has a configuration to handle your different custom headers. You just need to open web.config and search for customHeaders section.

 <location path="sitecore">
    <system.webServer>
      <httpProtocol>
        <customHeaders>
          <remove name="X-Content-Type-Options" />
          <remove name="X-XSS-Protection" />
          <remove name="Content-Security-Policy" />
          <add name="X-XSS-Protection" value="1; mode=block" />
          <add name="X-Content-Type-Options" value="nosniff " />
          <add name="Content-Security-Policy" value="default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' 'unsafe-inline' https://fonts.gstatic.com; upgrade-insecure-requests; block-all-mixed-content;" />
        </customHeaders>
      </httpProtocol>

You can try this.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.