Make X-Frame-Options configureable

[eloo]

Is your feature request related to a problem? Please describe.
Hi, i would like to ask if it could be possible to make the "X-Frame-Options" header of the UI configureable.
Background for this request is that i use the Docker version of RaspberryMatic on my OdroidC2 (armbian) and i want to have the webui embed in my homeassistant sidebar.

I use the homeassistant panel_iframe functionality to achieve this. But with the current setting of the X-Frame-Options i'm not able to embed it as the security policy is set to same_origin which also includes the port.

So i would like to change the policy to something like

X-Frame-Options: ALLOW-FROM https://example.com/

So i can embed the raspberry matic in my homeassistant.

Describe the solution you'd like

I guess a easy solution could be make the "X-Frame-Options" configureable for example by env variable so it could be used in docker with ease.

e.g.

UI_XFRAME_OPTIONS: "ALLOW_FROM https://address-for-homeassistant.domain" 

Describe alternatives you've considered

As the X-Frame-Options seems to be deprecated already maybe switching to content-security-policy would also makes sense

Additional context
Not sure if you need more background. If so, please feel free to ask.

Thanks
eloo

[jens-maus]

I am sorry, but I think making X-Frame-Options configurable would only be half of the story. In fact, like with the direct HomeAssistat add-on integration you would need something like a proxy (cf. https://github.com/jens-maus/RaspberryMatic/blob/master/buildroot-external/overlay/base-raspmatic_oci/bin/ha-proxy.js) which converts all internally used WebUI URL requests and links to appropriate relative links/URLs.

[eloo]

Hi @jens-maus
i'm not sure why i would need a proxy here? I just want to embed it as iframe.
I've also tested it by mounting a manipulated setenv.conf into lighttpd whre i have uncommented the x-frame-options (allow) and its working as expected.

So i really don't see the need for converting any calls.

What do you think?

[jens-maus]

i'm not sure why i would need a proxy here? I just want to embed it as iframe.
I've also tested it by mounting a manipulated setenv.conf into lighttpd whre i have uncommented the x-frame-options (allow) and its working as expected.

Well, I am not sure if I understand correctly what you are exactly doing or what you exactly want to achieve. Thus, you probably need to outline it a bit more or provide more examples.

However, if simply manipulating setenv.conf already works you can try to put your own lighttpd *.conf file under /usr/local/etc/config/lighttpd/ which is then located within the userspace filesystem and thus would allow you to override certain lighttpd settings.

[eloo]

Okay,

the idea is to just embed the raspberry-matic ui as an iframe into homeassistant.
I'm not using the addon or so on.. I'm running raspberry-matic as standalone docker container.

And to make the access to raspberry-matic easy for me i want to use and panel_iframe in homeassistant
https://www.home-assistant.io/integrations/panel_iframe/

But currently this is not possible because of the mentioned header.
So the idea is to make it possible to configure this header to your needs.

For me the docker-volume workaround is fine enough.
But in general it would be nice to have this configurable or at least documented.

Best regards
eloo

[stale[bot]]

Thanks for your contribution!
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs within the next 7 days. Please check if the issue is still relevant in the most current version of RaspberryMatic and tell us. Also check that all relevant details,

---

Vielen Dank für die Unterstützung!
Dieses Problem wurde automatisch als veraltet markiert, da es in letzter Zeit keine Aktivitäten gab. Es wird geschlossen, wenn nicht innerhalb der nächsten 7 Tage weitere Aktivitäten stattfinden. Bitte überprüfen Sie, ob das Problem auch in der aktuellsten Version von RaspberryMatic noch relevant ist, und teilen Sie uns dies mit. Überprüfen Sie auch, ob alle relevanten Details, Logs und Reproduktionsschritte enthalten sind oder aktualisiert werden müssen.

[stale[bot]]

This issue has been automatically closed because of inactivity. Please open a new issue if still relevant and make sure to include all relevant details, logs and reproduction steps.

---

Dieses Problem wurde aufgrund von Inaktivität automatisch geschlossen. Bitte öffnen Sie ein neues Issue, falls dies noch relevant ist und stellen Sie sicher das alle relevanten Details, Logs und Reproduktionsschritte enthalten sind.

[gucki]

@jens-maus I already have other control panels integrated into my Home Assistant UI, for example, zigbee2mqtt and zwave2mqtt. I'd like to do the same with HomeMatic and currently, the site isn't loading because of the X-Frame-Options header. It'd be great to change the header by configuring either in the UI or setting it using an ENV variable (ex when using docker).

[alxbauer]

To remove the X-Frame-Options header create a file: /usr/local/etc/config/lighttpd/setenv.conf

# Remove X-Frame-Options
$HTTP["url"] =~ "^/" {
  setenv.set-response-header = (
    "X-Frame-Options" => ""
  )
}

Restart the http server
/etc/init.d/S50lighttpd restart

Done.

[Jojo-A]

Perfect, this is exactly what I was looking for! This should be mentioned somewhere more obvious because it makes the integration into HA so smoothly when using a dedicated CCU :) 👍

[gucki]

@alxbauer Thank you, works like a charm (also with docker installation).

[ZTHawk]

Even though this is an old thread I would like to share my solution which is based on @alxbauer's solution (maybe it will help others like it helped me). I think it is a bit more secure than disabling X-Frame.

$HTTP["url"] =~ "^/" {
  setenv.add-response-header += (
    "Content-Security-Policy" => "frame-ancestors 'self' https://myhomeassistant.mydomain.tld;"
  )
}

That way I could embed the raspberry site in an iframe in https://myhomeassistant.mydomain.tld.