CORS and pdf frame - Githubissues

docdoku / docdoku-plm

The project purpose is to develop a comprehensive, robust open source PLM (Product LifeCycle Management) solution.

http://www.docdokuplm.com

GNU Affero General Public License v3.0

241 stars 98 forks source link

CORS and pdf frame #1163

Open mguimard opened 6 years ago

mguimard commented 6 years ago

PDF doesn't show up with cors

Refused to display 'http://localhost:10080/eplmp-server-rest/api/files/demo/documents/test/A/1/[...]&output=pdf&type=viewer' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Steps to reproduce

use cors
upload an office file to a document
open the document permalink
access the file tab

ludoBarel commented 5 years ago

About X-Frame-Options troubles :

Same error can appear when export a part in order to put it in other host page due to origin of the resources demand.
Use Content-Security-Policy rather than X-Frame-Options.
A solution will be to add the Content-Security-Policy in headers of responses from server which deliver static content.
Take care about compatibility between browser.
For local development with npm serve-static must find a way to add Content-Security-Policy in headers responses.