# Collabora + Nextcloud can't open document online, frame ancestor issue

**URL:** <https://forum.collaboraonline.com/t/collabora-nextcloud-cant-open-document-online-frame-ancestor-issue/3650>\
**Category:** Installation & Configuration\
**Created:** [May 5, 2025, 12:31pm UTC](https://forum.collaboraonline.com/t/collabora-nextcloud-cant-open-document-online-frame-ancestor-issue/3650 "2025-05-05T12:31:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![william](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william](https://forum.collaboraonline.com/u/william)\
**Post date:** [May 5, 2025, 12:31pm UTC](https://forum.collaboraonline.com/t/collabora-nextcloud-cant-open-document-online-frame-ancestor-issue/3650/1 "2025-05-05T12:31:55Z")

</div>

Hi,  
I’m running a LAMP nextcloud and have installed Collabora through package manager. Both running on the same VPS. So far I can’t open any document with firefox, it complains about frame ancestor. `Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-ancestors) at <unknown> because it violates the following directive: “frame-ancestors 'self'”`

For installation I followed this guide: [Collabora integration guide - 📑 How to - Nextcloud community](https://help.nextcloud.com/t/collabora-integration-guide/151879) . In the admin interface I see a green check mark so connection is ok from there. I can also access CODE admin panel from outside.

For trouble shoot I followed this [Cross-origin frame problems - #4 by darshan](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099/4) . But my problem seems to be different because setting the frame ancestor manually doesn’t help.

In firefox when I open `cool.html` I see that the frame ancestors should be correctly set already.

```auto

      <input type="hidden" id="initial-variables"
      data-host = "wss://<office-url>"
      data-service-root = ""
      data-hexify-url = "false"
      data-version-path = "b7ba9a23ba"
      data-access-token = ""
      data-access-token-ttl = "0"
      data-access-header = ""
      data-post-message-origin-ext = ""
      data-cool-logging = ""
      data-coolwsd-version = "24.04.13.3"
      data-enable-welcome-message = "true"
      data-auto-show-welcome = "false"
      data-auto-show-feedback = "false"
      data-allow-update-notification = "true"
      data-user-interface-mode = "notebookbar"
      data-use-integration-theme = "false"
      data-statusbar-save-indicator = "true"
      data-enable-macros-execution = "false"
      data-enable-accessibility = "false"
      data-out-of-focus-timeout-secs = "300"
      data-idle-timeout-secs = "900"
      data-min-saved-message-timeout-secs = "6";
      data-protocol-debug = "false"
      data-enable-debug = "false"
      data-frame-ancestors = "%20<office-url>:%2A%20<nextcloud-url>:%2A"
      data-socket-proxy = "false"
      data-ui-defaults = "e30="
      data-check-file-info-override = "{}"
      data-deepl-enabled = "false"
      data-zotero-enabled = "true"
      data-document-signing-enabled = "true"
      data-saved-ui-state = "true"
      data-extra-export-formats = ""
      data-wasm-enabled = "false"
      data-indirection-url = ""
      data-geolocation-setup = "%GEOLOCATION_SETUP%"
      data-canvas-slideshow-enabled = "true"
      />

```

I’m out of ideas what went wrong. I noticed there’s an extra `;` in `data-min-saved-message-timeout-secs` but I don’t know if this is relevant.

Best regards,  
William

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [May 6, 2025, 4:10pm UTC](https://forum.collaboraonline.com/t/collabora-nextcloud-cant-open-document-online-frame-ancestor-issue/3650/2 "2025-05-06T16:10:53Z")

</div>

Hi @william ,

Thanks for the detailed information. From what you’re describing, the root issue is the **`Content-Security-Policy` (CSP)** — specifically the `frame-ancestors` directive — which is being enforced by your **Nextcloud server** , not Collabora.

### TL;DR:

**Your browser is blocking the Collabora iframe inside Nextcloud due to CSP settings on the _Nextcloud_ side.**

Still i would recommend to serach in collabora online forum with keyword LAMP. For example i found this thread [Nextcloud connects fine to CODE docker container but can't open any documents - #3 by Tex](https://forum.collaboraonline.com/t/nextcloud-connects-fine-to-code-docker-container-but-cant-open-any-documents/2415/3)

may or may not solve your issue but yes you can always search through the previous topics. I am sure i have seen few LAMP issues in past. So can you please search and see if find anything ?

let me know

Thanks  
|Darshan

---

<div class="post-metadata">

**Author:** ![william](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william](https://forum.collaboraonline.com/u/william)\
**Post date:** [May 7, 2025, 9:43am UTC](https://forum.collaboraonline.com/t/collabora-nextcloud-cant-open-document-online-frame-ancestor-issue/3650/3 "2025-05-07T09:43:11Z")

</div>

Thanks for the reply. I managed to solved the issue. I was inspired by this thread: [Debugging help - Nextcloud- coolwsd servers - #8 by FamousL](https://forum.collaboraonline.com/t/debugging-help-nextcloud-coolwsd-servers/3269/8)

Turns out, I’ve set `Header set Content-Security-Policy "frame-ancestors 'self';"` in my apache config as a security measure. Previously with only nextcloud running on the server, this works just fine. But not with Collabora added to the setup. Now I’ve commented out this config line, I can finally open documents.

The tricky part of my issue was that none of the logs show any errors, neither nextcloud nor CODE nor apache told me something went wrong. CODE just had one warning `convert-to: Requesting address is denied: ***.***. **.** ` but it was not relevant.

The config in question is a line provided by the apache installation in `etc/apache2//conf-enabled/security.conf`. Do you know if I can somehow modify this line to make it secure against other types of attacks while enabling CODE access?

Regards,  
William

---

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [May 8, 2025, 6:40am UTC](https://forum.collaboraonline.com/t/collabora-nextcloud-cant-open-document-online-frame-ancestor-issue/3650/4 "2025-05-08T06:40:30Z")

</div>