element in a cross-origin subframe.` Then I fiddled with trying to print (I think it tries to open another window), it fails and I get these errors: ```auto Refused to frame '' because it violates the following Content Security Policy directive: "frame-src 'self' https://rating.collaboraonline.com https://rating.collaboraonline.com blob:". bundle.js:22209 Uncaught SecurityError: Failed to read a named property 'print' from 'Window': Blocked a frame with origin "https://docs.domain.ca" from accessing a cross-origin frame. at NewClass._onIframeLoaded (bundle.js:22209:73) ``` In apache2 I have tried playing with the following From my custom app which is just domain.ca, I have this in apache which is where CODE is ```auto Header set Content-Security-Policy: "frame-ancestors https://docs.domain.ca https://docs.domain.ca:9980 " Header set Content-Security-Policy: "frame-src https://docs.domain.ca https://docs.domain.ca:9980 blob:;" ``` I even tried vise versa, and went into my docs.domain.ca in apache to add ```auto Header set Content-Security-Policy: "frame-ancestors https://domain.ca https://domain.ca:9980 " Header set Content-Security-Policy: "frame-src https://domain.ca https://domain.ca:9980 blob:;" ``` I also tried with these host to just allow it all. But nothing is working so I must be doing something wrong `Header set Access-Control-Allow-Origin "*"` What am I doing wrong to allow my domain.ca to accept cross-origin? ---

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\ **Post date:** [October 25, 2024, 10:50am UTC](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099/2 "2024-10-25T10:50:11Z")

hii @gstlouis Welcome to collabora online forums. ### **Adjust Collabora Online Configuration** To allow embedding and communication across frames, make sure you have set the appropriate `alias_groups` settings in your CODE’s `coolwsd.xml`: xml Copy code ```auto * ``` This will help ensure that the CODE server allows requests from your app’s domain. i found a thread which has the similar thing, please refer to this solution once 🙂 > [@Unable to restrict allowed WOPI hosts](https://forum.collaboraonline.com/t/unable-to-restrict-allowed-wopi-hosts/2611/2): > > I think I figured it out. Setting the loglevel to “information” reveals the behavior. As expected, when “mode” is set to “first”, then the first host that connects will be added to the list of trusted WOPI hosts. The log message will be: Adding trusted WOPI host: [hostname] Interestingly, the behavior is the same when setting “mode” to “groups” but not defining any groups or only empty groups. Now onto why I could not lock out my own Nextcloud with the setting in my original post: The loca… Thanks, Darshan ---

**Author:** ![gstlouis](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/gstlouis/32/467_2.png) [@gstlouis](https://forum.collaboraonline.com/u/gstlouis)\ **Post date:** [October 25, 2024, 3:11pm UTC](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099/3 "2024-10-25T15:11:58Z")

@darshan Thank you for your comments. I do have my alias\_groups setup properly with groups because all domains can access CODE. In my coolwsd.xml I can see I have which holds a lot of information within this frame. I have added like the following ```auto * ``` The above domain.ca is the target custom APP, and the docs.domain.ca is where CODe lives. restart coolwsd and it did not work I still have the same errors in console. I can see in frame\_ancestors meta tag desc says OBSELETE. I know this should not cause any issues but I can’t find any information how to use content\_security\_policy instead. open to any other ideas. Thank you ---

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\ **Post date:** [October 28, 2024, 8:22am UTC](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099/4 "2024-10-28T08:22:55Z")

The `frame_ancestors` tag being marked as obsolete in the `coolwsd.xml` configuration file indicates that you should now use the `content_security_policy` (CSP) directive instead, which provides more granular control over security policies for content embedding. Since you’re still encountering issues even after modifying your configuration, let’s focus on implementing a correct `content_security_policy`. ### Possible solution: 1. **Remove the `frame_ancestors` Setting** Since `frame_ancestors` is obsolete, and you’re instructed to use `content_security_policy`, you can safely remove or comment out the `` tag from the `coolwsd.xml`. The relevant portion should now look like this: 2. **Customizing `content_security_policy`** The `content_security_policy` tag accepts a string in CSP format. Here’s an example that should allow your custom app (running on `domain.ca`) to embed documents from your CODE instance (`docs.domain.ca`), and allow operations like file access via blobs, printing, and others: 3. **Ensure Correct Server Headers (Apache/Nginx)** You mentioned configuring CSP headers on the Apache side, but you should ensure that the headers set by Apache do not conflict with the `content_security_policy` in `coolwsd.xml`. Either remove them from Apache or set them only for specific routes to avoid overriding the CSP set by Collabora. You can add the CSP in Apache like this: 4. **Restart the Services** After applying these changes, restart both the `coolwsd` service and your web server (Apache or Nginx) to apply the updated configuration: 5. **Check Browser Dev Tools Again** After restarting, check your browser’s developer tools for any CSP-related errors. The headers should now reflect your changes, and the cross-origin errors related to iframe embedding or autofocusing should no longer appear. ### If Issues Persist If after implementing this, you still see errors related to printing or iframe access: - Ensure there are no `sandbox` attributes or policies applied to the iframe from your web app’s side. - Verify that no other Apache/Nginx reverse proxy settings are interfering with the requests. - Try to load the Collabora iframe directly and check if CSP issues arise only when embedded via your app or generally. These steps should resolve the issue. All the best , Darshan ---

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\ **Post date:** [November 1, 2024, 9:02am UTC](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099/5 "2024-11-01T09:02:08Z")