Description

https://sunbeam.city/@notplants/113625841650195515

User was trying to run CryptPad on a server which was based on YunoHost. YunoHost sets X-Frame-Options: SAMEORIGIN across the board.

This causes CryptPad to fail and display a network error in the web browser. It fails so hard it can't even display an error message:

Steps to reproduce

Host behind an HTTP reverse proxy which sets the X-Frame-Options: SAMEORIGIN response header.

Relevant logs

See screenshots

Expected behavior

As an iframe user, Cryptpad should check to make sure that the X-Frame-Options is not set or is set correctly, and warn the user if it is not.

This JavaScript should do it. You just need to pass the sandbox origin to the JS somehow so it can run on page load before the iframe attempts to load:

(() => {
    const sandboxOrigin = 'https://sandbox-crypt.commoninternet.net'
    fetch(window.location.origin).then(response => {
        const header = response.headers.get('x-frame-options');
        if(header && (!header.includes('ALLOW-FROM') || !header.includes(sandboxOrigin))) {
            alert(
              "Your HTTP server is messing up the X-Frame-Options header, which breaks CryptPad's OnlyOffice"+
              " sandbox and thus breaks the app. "+
              "Please configure your server to leave the existing X-Frame-Options header in peace"
            )
        }
    })
})()

Which operating system are you using?

Linux/BSD/UNIX

What browsers are you seeing the problem on?

Mozilla Firefox

Extensions

N/A (CryptPad version 5.3.0)

Version

Other