Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Most recent Safari version doesn't process shared Kibana dashboards in iframe due to CSP violation #150162

Closed
Tracked by #168126
mpbraendle opened this issue Feb 2, 2023 · 3 comments
Labels
bug Fixes for quality problems that affect the customer experience Feature:Embedding Embedding content via iFrame impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. loe:large Large Level of Effort Team:Presentation Presentation Team for Dashboard, Input Controls, and Canvas Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience)

Comments

@mpbraendle
Copy link

**Kibana version: 8.5.2

**Elasticsearch version: 8.5.2

**Browser version: Safari 16.3

**Browser OS version: Mac OS 12.6.3, iOS 16.3

**Describe the bug:
The most recent Safari version doesn't process a shared Kibana dashboard in an iframe

Steps to reproduce:
Go to https://www.zora.uzh.ch using Safari 16.3

Dashboard under "Open Access Distribution" isn't displayed. See errors in browser console below.

This dashboard is embedded as an iframe from https://www.kibanapublic.uzh.ch/s/oam/app/dashboards?auth_provider_hint=anonymous1#/view/8f7c8fce-4bb3-574f-84c7-6ae2c7467901?embed=true&_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now-100y,to:now))&hide-filter-bar=true into www.zora.uzh.ch . The former URL (open iframe in new tab) works.

Expected behavior:
Older Safari browsers, Firefox, Google Chrome do work.

Errors in browser console (if relevant):

Many errors are displayed, but the most relevant is:
"Refused to execute a script because its hash, its nonce, or 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy (dashboard.js, line 286)"

@mpbraendle mpbraendle added the bug Fixes for quality problems that affect the customer experience label Feb 2, 2023
@botelastic botelastic bot added the needs-team Issues missing a team label label Feb 2, 2023
@dej611 dej611 added Team:Presentation Presentation Team for Dashboard, Input Controls, and Canvas Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience) labels Feb 7, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-presentation (Team:Presentation)

@elasticmachine
Copy link
Contributor

Pinging @elastic/appex-sharedux (Team:SharedUX)

@botelastic botelastic bot removed the needs-team Issues missing a team label label Feb 7, 2023
@ThomThomson ThomThomson added the impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. label Feb 7, 2023
@ThomThomson
Copy link
Contributor

Closing this for the time being. It will be tracked in our Icebox for Iframe / Embedding issues and will be re-opened if our priorities change.

@ThomThomson ThomThomson added loe:large Large Level of Effort Feature:Embedding Embedding content via iFrame labels Jun 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Embedding Embedding content via iFrame impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. loe:large Large Level of Effort Team:Presentation Presentation Team for Dashboard, Input Controls, and Canvas Team:SharedUX Team label for AppEx-SharedUX (formerly Global Experience)
Projects
None yet
Development

No branches or pull requests

4 participants