Public calendar iframe has issues on some browsers #169

tcitworld · 2016-11-07T17:40:44Z

OS	Linux	Windows
Firefox	Works	Works
Chrome 54	Displays the grid, not the events. When refreshed, redirect issue.	Displays the grid, not the events. When refreshed, redirect issue.
Chromium 53	Works	Not tested
Chromium 54	Not tested	Displays the grid, not the events. When refreshed, redirect issue.
Edge	Not available	Works
IE 12	Not available	Displays the grid, not the events

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

tcitworld · 2016-11-07T17:43:04Z

@georgehrke Can you test on Safari ?

tcitworld · 2016-11-07T17:46:11Z

The Chrome error is ERR_TOO_MANY_REDIRECTS

georgehrke · 2016-12-06T21:37:02Z

@tcitworld Do you have some example code for me?
Did you just include the iframe into an otherwise blank html file?

georgehrke · 2016-12-17T10:51:07Z

ping @tcitworld ^ :)

tcitworld · 2016-12-17T11:05:40Z

For instance this one works with Firefox and Chromium but not Chrome on Linux : http://www.berrylab36.org/Ouverture

Here it's embeed within SPIP but I've heard of the same issue with a Wordpress. Will try myself.

georgehrke · 2016-12-21T07:42:37Z

Safari 10 on macOS works just fine for me.

georgehrke · 2016-12-21T08:03:43Z

I see a few issues here.
To my knowledge there is no X-FRAME-OPTIONS: ALLOW. There is only DENY, SAMEORIGIN and ALLOW-FROM https://...

Further Chrom(e|ium) doesn't support X-Frame-Options.
It expects something like Content-Security-Policy: frame-ancestors my-trusty-site.com
Source: https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet#Preventing_Clickjacking

Also Chrom(e|ium) got more strict about https lately.
Maybe it's related to the fact, the berrylab36.org is http, but framagenda.org is https. (at least when sending requests like PROPFIND or so)

Maybe @LukasReschke has more insights here

georgehrke · 2016-12-24T14:53:01Z

IE doesn't work for the same reason the calendar app itself doesn't work in Internet explorer.

Should we display some overlay asking the user to use a different webbrowser?

tcitworld · 2016-12-27T10:50:04Z

I guess this needs some tweaking.

tcitworld · 2016-12-27T10:52:04Z

Will see how nextcloud/server#1472 handles things.

enoch85 · 2017-03-12T11:31:12Z

I can confirm this. Got redirected to many times Chrome version 56.0.2924.87 (64-bit)

enoch85 · 2017-03-12T11:34:17Z

Maybe my Ǹextcloud is to secure?

Firefox

Load denied by X-Frame-Options: https://cloud.techandme.se/apps/calendar/public/G1ZXEIKC3AGL8X4S does not permit cross-origin framing.

georgehrke · 2017-03-19T14:07:06Z

Maybe @LukasReschke has more insights here

@LukasReschke ping :)

georgehrke · 2017-03-19T14:07:29Z

IE doesn't work for the same reason the calendar app itself doesn't work in Internet explorer.
Should we display some overlay asking the user to use a different webbrowser?

At least IE 11 should be fixed by now

flips · 2017-03-21T17:50:24Z

Seeing the same " redirected you too many times" in both Opera 43.0.2442.1165 and Chrome 57.0.2987.110. In Firefox 52.0.1 only seeing blank iframe. (macOS 10.12, all 64 bit browsers)

georgehrke · 2017-03-21T17:51:07Z

We don't support Opera. Will definitely look into the Chrome and Firefox issue

flips · 2017-03-21T18:09:28Z

When I used http://www.tinywebgallery.com/blog/advanced-iframe/free-iframe-checker
it also complained about the X-FRAME-OPTIONS ... (As mentioned previously here)
Placing my test.html file on the same domain as my NextCloud installation, the iFrame started working in Firefox, but not in Safari (10.0.3) or Chrome (where they are now both blank, I don't get the framing or anything, and not the same too many redirects error).

georgehrke · 2017-04-02T09:44:09Z

This requires changes to the Nextcloud server, to be released with Nextcloud 12.
Rescheduling this ticket to Calendar 1.7.0

law · 2017-08-01T08:18:22Z

Still seeing this issue on Nextcloud 12 and Chrome. tl; dr - firefox and safari work, Chrome throws a redirect error.

haug-den-lucas · 2018-01-28T23:09:01Z

Error still exists.
I'd really love to add the iframe to my webpage, but sadly it still doesn't work.
Any fixes or workarounds?

georgehrke · 2018-01-29T09:30:09Z

@Ich5003 What Browser, Nextcloud version, calendar app version?

tcitworld · 2018-10-02T20:14:35Z

Thanks to nextcloud/server#11433 we should be good with NC15.

rullzer · 2018-10-02T20:27:18Z

Yes you should.
Would be good of course if somebody coould setup a test server and test it 😉

tcitworld · 2018-10-07T14:56:33Z

@rullzer I tested and we're still blocked by https://github.com/nextcloud/server/blob/master/lib/private/AppFramework/Middleware/Security/SameSiteCookieMiddleware.php#L60-L61 which triggers 302s for every request.

rullzer · 2018-10-16T12:35:52Z

Ah ok. So the check I had in mind doesn't fully work. As that would with the current logic log you out of your nextcloud if you embed a page.

Thinking more this would need a few adjustments

calendar endpoint must of course be marked with @NoSameSiteCookieRequired
The css and js endpoint should be marked as such I don't think this hurts as this is public info anyway
The theming endpoints should be marked as such. Also should not be that much of an issue as they just serve generic theming info

tcitworld · 2018-10-17T07:21:11Z

Works perfectly ! Will send PRs. :)

Fixes #169 (will probably require NC 15 though) Signed-off-by: Thomas Citharel <tcit@tcit.fr>

Which can be used for public iframe embeeding See nextcloud/calendar#169 Signed-off-by: Thomas Citharel <tcit@tcit.fr>

FredMa01 · 2020-02-19T16:14:54Z

Same issue. Embed code generate this error :`

The page is not redirected correctly
An error occurred while connecting to framagenda.org.
The cause of this problem can be the deactivation or refusal of cookies.

fpoulain · 2020-04-02T15:51:31Z

Using the embed link on a recent NC 18, I am receiving

Content-Security-Policy: ... 'self';frame-ancestors 'self'; ...

Consequently Firefox block the content loading, even from a parent domain (X-Frame-Option is ignored when CSP is defined). Afaik there is no option in NC to define a « trusted embeder ». Moreover, may be the embed link should allow anyone to embed.

I overcame the situation by munging Content-Security-Policy by this kludge on my reverse proxy:

       location / {
               proxy_pass http://xxx.xxx.xxx.xxx;
               location /nextcloud/apps/calendar/embed/ {
                       proxy_pass http://xx.xx.xx.xx;
                       proxy_hide_header Content-Security-Policy;
                       add_header Content-Security-Policy "frame-ancestors 'self' https://ourwebsite.com https://www.ourwebsite.com";
               }
       }

rullzer · 2020-04-02T17:28:27Z

A fixis already in master. and will be in the next release.
CC: @georgehrke

nd- · 2020-06-09T18:45:45Z

Hello, NC 18.0.6 and I still have this problem.
Is it supposed to be fixed with the latest releases ?

I even added the headers mentionned by @fpoulain (Content-Security-Policy "frame-ancestors 'self' https://ourwebsite.com") but nada...

nderambure · 2020-06-09T20:41:54Z

Same here.

georgehrke · 2020-06-09T21:23:46Z

It should work on Nextcloud 19. There are known issues with Nextcloud 18 and below.

nd- · 2020-06-09T23:23:31Z

I updated to NC 19 (on the beta channel), it still doesn't work.

With Chrome, I still see these errors in the console coming from the calendar url when I browse the page with an iframe:
Failed to load resource: the server responded with a status of 503 (Service Unavailable)
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

gelmio · 2020-09-21T09:42:57Z

It should work on Nextcloud 19. There are known issues with Nextcloud 18 and below.

We updated to NC19 and still have the same issue; firefox requests still returning a 503; chrome is fine.

ashnansen · 2021-01-20T15:31:08Z

There are also a problem with embeding it in wordpress

tcitworld added the bug label Nov 7, 2016

tcitworld self-assigned this Nov 7, 2016

georgehrke added this to the 1.5.0-current milestone Nov 29, 2016

georgehrke added the 1. to develop Accepted and waiting to be taken care of label Dec 6, 2016

georgehrke modified the milestones: 1.6.0-next, 1.5.0-current Jan 16, 2017

georgehrke modified the milestones: 1.7.0-next, 1.6.0-current Apr 2, 2017

tcitworld mentioned this issue Jun 19, 2017

Add CSP frame-ancestors support nextcloud/server#5462

Merged

tcitworld added a commit that referenced this issue Oct 17, 2018

Add @NoSameSiteCookieRequired to the publicIndexForEmbedding endpoint

8dd1815

Fixes #169 (will probably require NC 15 though) Signed-off-by: Thomas Citharel <tcit@tcit.fr>

tcitworld added a commit to nextcloud/server that referenced this issue Oct 17, 2018

Don't require Same Site Cookies on assets

d63de54

Which can be used for public iframe embeeding See nextcloud/calendar#169 Signed-off-by: Thomas Citharel <tcit@tcit.fr>

This was referenced Oct 17, 2018

Don't require Same Site Cookies on assets nextcloud/server#11878

Merged

Add @NoSameSiteCookieRequired to the publicIndexForEmbedding endpoint #924

Merged

georgehrke closed this as completed in #924 Oct 17, 2018

weeman1337 pushed a commit to nextcloud/server that referenced this issue Oct 28, 2018

Don't require Same Site Cookies on assets

3d3b50e

Which can be used for public iframe embeeding See nextcloud/calendar#169 Signed-off-by: Thomas Citharel <tcit@tcit.fr>

tcitworld mentioned this issue Nov 26, 2018

Same site cookie issues nextcloud/server#12670

Closed

tcitworld mentioned this issue Oct 25, 2019

Embed calendar blocked by Content-Security-Policy : frame-ancestors 'self' #1584

Closed

georgehrke reopened this Oct 25, 2019

tcitworld mentioned this issue Jan 15, 2020

Feature request: Share multiple calendars in one link #708

Closed

georgehrke mentioned this issue Jan 19, 2020

Embed Code does not work #1861

Closed

This comment has been minimized.

Sign in to view

szimszon mentioned this issue Feb 14, 2020

Nextcloud public and embeddable calendar page include as Widget element-hq/element-web#11985

Closed

This comment has been minimized.

Sign in to view

tcitworld closed this as completed Apr 2, 2020

SergeyMosin mentioned this issue May 21, 2020

[Feature] The public links doesn't work in a iframe SergeyMosin/Appointments#74

Closed

Public calendar iframe has issues on some browsers #169

Public calendar iframe has issues on some browsers #169

Comments

tcitworld commented Nov 7, 2016 • edited by jospoortvliet Loading

tcitworld commented Nov 7, 2016

tcitworld commented Nov 7, 2016

georgehrke commented Dec 6, 2016

georgehrke commented Dec 17, 2016

tcitworld commented Dec 17, 2016 • edited Loading

georgehrke commented Dec 21, 2016

georgehrke commented Dec 21, 2016

georgehrke commented Dec 24, 2016

tcitworld commented Dec 27, 2016

tcitworld commented Dec 27, 2016

enoch85 commented Mar 12, 2017

enoch85 commented Mar 12, 2017 • edited Loading

georgehrke commented Mar 19, 2017

georgehrke commented Mar 19, 2017

flips commented Mar 21, 2017

georgehrke commented Mar 21, 2017

flips commented Mar 21, 2017 • edited Loading

georgehrke commented Apr 2, 2017

law commented Aug 1, 2017

haug-den-lucas commented Jan 28, 2018 • edited Loading

georgehrke commented Jan 29, 2018

tcitworld commented Oct 2, 2018

rullzer commented Oct 2, 2018

tcitworld commented Oct 7, 2018

rullzer commented Oct 16, 2018

tcitworld commented Oct 17, 2018

This comment has been minimized.

This comment has been minimized.

FredMa01 commented Feb 19, 2020 • edited Loading

fpoulain commented Apr 2, 2020 • edited Loading

rullzer commented Apr 2, 2020

nd- commented Jun 9, 2020

nderambure commented Jun 9, 2020

georgehrke commented Jun 9, 2020

nd- commented Jun 9, 2020 • edited Loading

gelmio commented Sep 21, 2020

ashnansen commented Jan 20, 2021

tcitworld commented Nov 7, 2016 •

edited by jospoortvliet

Loading

tcitworld commented Dec 17, 2016 •

edited

Loading

enoch85 commented Mar 12, 2017 •

edited

Loading

flips commented Mar 21, 2017 •

edited

Loading

haug-den-lucas commented Jan 28, 2018 •

edited

Loading

FredMa01 commented Feb 19, 2020 •

edited

Loading

fpoulain commented Apr 2, 2020 •

edited

Loading

nd- commented Jun 9, 2020 •

edited

Loading