Can't make the --allow-iframe or --bypasshelmet work, still showing X-Frame-Options: SAMEORIGIN #380

jewscojacquez · 2022-02-03T19:26:44Z

Describe the bug

Hello,

I'm trying to embed WeTTY on my apache hosted page using HTML iframe. I got a error saying refused to connect. After digging, I found out that there is a option --allow-iframe but after passing it and restarting the wetty, I still got the same error. I also tried the --bypasshelmet with the same error.

The HTTPD is listening on port 80
The WeTTY is listening on port 3000

My HTML looks like this;

lxutlhpocdevs03 Console

To Reproduce
Steps to reproduce the behavior:

SERVER - First Try passing bypasshelmet

[root@lxutlhpocdevs03 wetty]# wetty --version
2.3.0
[root@lxutlhpocdevs03 wetty]# wetty --ssh-host lxutlhpocdevs02.example.com --bypasshelmet
{"base":"/wetty/","label":"Wetty","level":"info","message":"Starting server","port":3000,"timestamp":"2022-02-03T19:05:35.184Z","title":"WeTTY - The Web Terminal Emulator"}
{"connection":"http","label":"Wetty","level":"info","message":"Server started","port":3000,"timestamp":"2022-02-03T19:05:35.209Z"}
{"label":"Wetty","level":"http","message":"HEAD /wetty 200 7ms","meta":{"req":{"headers":{"accept":"/","host":"lxutlhpocdevs03.example.com:3000","user-agent":"curl/7.61.1"},"httpVersion":"1.1","method":"HEAD","originalUrl":"/wetty","query":{},"url":"/wetty"},"res":{"statusCode":200},"responseTime":7},"timestamp":"2022-02-03T19:05:46.679Z"}

CLIENT showing SAMEORIGIN with self security-policy

[s0998fue@lxutlhpocdevs03 test]$ curl --head http://lxutlhpocdevs03.example.com:3000/wetty
HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';font-src 'self' data:;connect-src 'self' ws://lxutlhpocdevs03.example.com:3000
X-DNS-Prefetch-Control: off
Expect-CT: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer-when-downgrade
X-XSS-Protection: 0
Content-Type: text/html; charset=utf-8
Content-Length: 1138
ETag: W/"472-S2vHeHsLjCISBT3Di/V0rk/j5T8"
Vary: Accept-Encoding
Date: Thu, 03 Feb 2022 19:05:46 GMT
Connection: keep-alive
Keep-Alive: timeout=5

2ND TRY with --allow-iframe together with bypasshelmet

[root@lxutlhpocdevs03 wetty]# wetty --ssh-host lxutlhpocdevs02.example.com --bypasshelmet --allow-iframe
{"base":"/wetty/","label":"Wetty","level":"info","message":"Starting server","port":3000,"timestamp":"2022-02-03T19:07:20.563Z","title":"WeTTY - The Web Terminal Emulator"}
{"connection":"http","label":"Wetty","level":"info","message":"Server started","port":3000,"timestamp":"2022-02-03T19:07:20.586Z"}
{"label":"Wetty","level":"http","message":"HEAD /wetty 200 6ms","meta":{"req":{"headers":{"accept":"/","host":"lxutlhpocdevs03.example.com:3000","user-agent":"curl/7.61.1"},"httpVersion":"1.1","method":"HEAD","originalUrl":"/wetty","query":{},"url":"/wetty"},"res":{"statusCode":200},"responseTime":6},"timestamp":"2022-02-03T19:07:24.006Z"}

CLIENT still showing SAMEORIGIN

[s0998fue@lxutlhpocdevs03 test]$ curl --head http://lxutlhpocdevs03.example.com:3000/wetty
HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';font-src 'self' data:;connect-src 'self' ws://lxutlhpocdevs03.example.com:3000
X-DNS-Prefetch-Control: off
Expect-CT: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer-when-downgrade
X-XSS-Protection: 0
Content-Type: text/html; charset=utf-8
Content-Length: 1138
ETag: W/"472-S2vHeHsLjCISBT3Di/V0rk/j5T8"
Vary: Accept-Encoding
Date: Thu, 03 Feb 2022 19:07:24 GMT
Connection: keep-alive
Keep-Alive: timeout=5

3RD TRY with allow-iframe only

[root@lxutlhpocdevs03 wetty]# wetty --ssh-host lxutlhpocdevs02.example.com --allow-iframe
{"base":"/wetty/","label":"Wetty","level":"info","message":"Starting server","port":3000,"timestamp":"2022-02-03T19:19:59.487Z","title":"WeTTY - The Web Terminal Emulator"}
{"connection":"http","label":"Wetty","level":"info","message":"Server started","port":3000,"timestamp":"2022-02-03T19:19:59.515Z"}
{"label":"Wetty","level":"http","message":"HEAD /wetty 200 7ms","meta":{"req":{"headers":{"accept":"/","host":"lxutlhpocdevs03.example.com:3000","user-agent":"curl/7.61.1"},"httpVersion":"1.1","method":"HEAD","originalUrl":"/wetty","query":{},"url":"/wetty"},"res":{"statusCode":200},"responseTime":7},"timestamp":"2022-02-03T19:20:06.652Z"}

CLIENT showing SAMEORIGIN

[s0998fue@lxutlhpocdevs03 test]$ curl --head http://lxutlhpocdevs03.example.com:3000/wetty
HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';font-src 'self' data:;connect-src 'self' ws://lxutlhpocdevs03.example.com:3000
X-DNS-Prefetch-Control: off
Expect-CT: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer-when-downgrade
X-XSS-Protection: 0
Content-Type: text/html; charset=utf-8
Content-Length: 1138
ETag: W/"472-S2vHeHsLjCISBT3Di/V0rk/j5T8"
Vary: Accept-Encoding
Date: Thu, 03 Feb 2022 19:20:06 GMT
Connection: keep-alive
Keep-Alive: timeout=5

Expected behavior
Is this the expected behavior? Is there anything wrong with the parameters that I passed?

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

OS: [windows 10]
Browser [chrome]
Version [97.0.4692.99 ]

Smartphone (please complete the following information):

Additional context
Add any other context about the problem here.

pablo-zarate · 2022-02-04T03:19:47Z

Did this at line 23 on server/socketServer/security.ts:

if (allowIframe) {

      helmet({
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'none'"],
        },
      },
      frameguard: false});

    };

Tested and works fine with the --allow-iframe now :)

butlerx · 2022-02-04T05:26:30Z

Thanks would you be able to make this in to a pr and I can merge it

pablo-zarate · 2022-02-04T15:04:06Z

It was easier than all those lines, just including the frameguard: false above.

Anyways, this fix shows ok for my usage and test env (nginx in the same host as wetty is being executed). Probably defaultSrc (or frameSrc) needs to be a parameter so CSP can allow certain addresses and to avoid disabling the whole CSP.

#381

jewscojacquez · 2022-02-07T18:05:46Z

Hi Pablo, thanks for your update.

I'm using wetty 2.3.0 and I can't find the security.ts file.

I tried updating the security.js instead and restart the service but still getting the sameorigin output.

The new Code(security.js)

[root@lxutlhpocdevs03 socketServer]# wetty --version
2.3.0
[root@lxutlhpocdevs03 socketServer]# pwd
/usr/local/share/.config/yarn/global/node_modules/wetty/build/server/socketServer

[root@lxutlhpocdevs03 socketServer]# cat security.js
import helmet from 'helmet';
export const policies = (allowIframe) => (req, res, next) => {
const args = {
referrerPolicy: { policy: ['no-referrer-when-downgrade'] },
contentSecurityPolicy: {
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "'unsafe-inline'", "'unsafe-eval'"],
styleSrc: ["'self'", "'unsafe-inline'"],
fontSrc: ["'self'", 'data:'],
connectSrc: [
"'self'",
(req.protocol === 'http' ? 'ws://' : 'wss://') + req.get('host'),
],
},
},
};

if (allowIframe) {
helmet({
contentSecurityPolicy: {
directives: {
defaultSrc: ["'none'"],
},
},
frameguard: false});

};
if (!allowIframe)
args.frameguard = { action: 'sameorigin' };
helmet(args)(req, res, next);
};
[root@lxutlhpocdevs03 socketServer]#

Restarted the service

[root@lxutlhpocdevs03 socketServer]# wetty --ssh-host lxutlhpocdevs02.example.com --allow-iframe --allow-remote-hosts
{"base":"/wetty/","label":"Wetty","level":"info","message":"Starting server","port":3000,"timestamp":"2022-02-07T18:03:18.230Z","title":"WeTTY - The Web Terminal Emulator"}
{"connection":"http","label":"Wetty","level":"info","message":"Server started","port":3000,"timestamp":"2022-02-07T18:03:18.261Z"}

Run the curl again

[root@lxutlhpocdevs03 ~]# curl --head http://lxutlhpocdevs03.example.com:3000/wetty
HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' 'unsafe-eval';style-src 'self' 'unsafe-inline';font-src 'self' data:;connect-src 'self' ws://lxutlhpocdevs03.example.com:3000
X-DNS-Prefetch-Control: off
Expect-CT: max-age=0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: no-referrer-when-downgrade
X-XSS-Protection: 0
Content-Type: text/html; charset=utf-8
Content-Length: 1138
ETag: W/"472-S2vHeHsLjCISBT3Di/V0rk/j5T8"
Vary: Accept-Encoding
Date: Mon, 07 Feb 2022 18:03:50 GMT
Connection: keep-alive
Keep-Alive: timeout=5

thanks
Jewsco

alonsomoya · 2022-06-22T19:54:10Z

It was easier than all those lines, just including the frameguard: false above.

Anyways, this fix shows ok for my usage and test env (nginx in the same host as wetty is being executed). Probably defaultSrc (or frameSrc) needs to be a parameter so CSP can allow certain addresses and to avoid disabling the whole CSP.

#381

#381 wasn't sufficient to me :( Only by adding this code block I can embed it on iframes

Did this at line 23 on server/socketServer/security.ts:
if (allowIframe) {

      helmet({
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'none'"],
        },
      },
      frameguard: false});

    };
Tested and works fine with the --allow-iframe now :)

jewscojacquez · 2022-08-15T12:58:46Z

pablo-zarate and alonsomoya, thanks! it works.

jewscojacquez closed this as completed Aug 15, 2022

cupanoodles mentioned this issue Dec 22, 2022

cannot embed wetty in iframe. #383

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't make the --allow-iframe or --bypasshelmet work, still showing X-Frame-Options: SAMEORIGIN #380

Can't make the --allow-iframe or --bypasshelmet work, still showing X-Frame-Options: SAMEORIGIN #380

jewscojacquez commented Feb 3, 2022 •

edited

Loading

pablo-zarate commented Feb 4, 2022 •

edited

Loading

butlerx commented Feb 4, 2022

pablo-zarate commented Feb 4, 2022

jewscojacquez commented Feb 7, 2022 •

edited

Loading

alonsomoya commented Jun 22, 2022

jewscojacquez commented Aug 15, 2022

Can't make the --allow-iframe or --bypasshelmet work, still showing X-Frame-Options: SAMEORIGIN #380

Can't make the --allow-iframe or --bypasshelmet work, still showing X-Frame-Options: SAMEORIGIN #380

Comments

jewscojacquez commented Feb 3, 2022 • edited Loading

lxutlhpocdevs03 Console

To Reproduce Steps to reproduce the behavior:

SERVER - First Try passing bypasshelmet

CLIENT showing SAMEORIGIN with self security-policy

2ND TRY with --allow-iframe together with bypasshelmet

CLIENT still showing SAMEORIGIN

3RD TRY with allow-iframe only

CLIENT showing SAMEORIGIN

pablo-zarate commented Feb 4, 2022 • edited Loading

butlerx commented Feb 4, 2022

pablo-zarate commented Feb 4, 2022

jewscojacquez commented Feb 7, 2022 • edited Loading

The new Code(security.js)

Restarted the service

Run the curl again

alonsomoya commented Jun 22, 2022

jewscojacquez commented Aug 15, 2022

jewscojacquez commented Feb 3, 2022 •

edited

Loading

To Reproduce
Steps to reproduce the behavior:

pablo-zarate commented Feb 4, 2022 •

edited

Loading

jewscojacquez commented Feb 7, 2022 •

edited

Loading