Content Security Policy and iframes

mcuos

Hi all,

One of our users wants to embed a JATOS study into a page from another application via an iframe.

From reading the documentation, it suggests setting the X-Frame-Options header to null. Unfortunately, this is a bit more permissive than I'd like, as I'd rather only allow a specific set of sites to embed JATOS.

From reading the source code, the CSP headers are set in application.conf, which is imported into jatos.conf, with the various elements from application.conf being manipulatable within it, so it looks like I can do this:

# Do not remove this line (it contains the default configuration)
include "application.conf"

# Add my override here
play.filters.csp.directives {
 frame-ancestors = "'self' permitteddomain1.com permitted2domain.com"
}

# HTTP address and port

I've given this a very cursory test, and it appears to work (the header contains the expected content).

Is this a sane approach? Or have I missed something in the documentation? Obviously modifying the configuration file is going to make upgrades more difficult (but there are ways to automate that)

Thanks 😀

kri

Hi!

I'm not an expert in CSP directives but I think you got a better approach to allowing iframes than JATOS' documentation has so far. I found this page that explains why it is the better choice.

So, yes I agree with you, it is a sane approach. And we should update the JATOS docs ;)

Best,

Kristian