# Iframe frame-ancestors issue

**URL:** <https://forum.collaboraonline.com/t/iframe-frame-ancestors-issue/649>\
**Category:** Installation & Configuration\
**Created:** [October 12, 2021, 11:10am UTC](https://forum.collaboraonline.com/t/iframe-frame-ancestors-issue/649 "2021-10-12T11:10:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![eugenem](https://avatars.discourse-cdn.com/v4/letter/e/3be4f8/32.png) [@eugenem](https://forum.collaboraonline.com/u/eugenem)\
**Post date:** [October 12, 2021, 11:10am UTC](https://forum.collaboraonline.com/t/iframe-frame-ancestors-issue/649/1 "2021-10-12T11:10:52Z")

</div>

When I try to open CODE in popup (iframe), I get following error:

Refused to frame ‘https ://oo.hlint.com/’ because an ancestor violates the following Content Security Policy directive: “frame-ancestors [oo.hlint.com](http://oo.hlint.com):\* [sl-test.hermonlabs.com](http://sl-test.hermonlabs.com):\*”.

This is the form that I submit:

`<form action="https://oo.hlint.com/loleaflet/d12ab86/loleaflet.html?WOPISrc=http://sl-test.hermonlabs.com:54321/wopi/files/56248" enctype="multipart/form-data" id="collabora-submit-form" method="post" novalidate="" target="collabora-online-viewer" ><input id="access-token" name="access_token" type="hidden" value="test"><input type="submit" value=""></form>`

From what I see, CODE is adding both its own host and wopi host to frame-ancestors. For some reason, chrome doesn’t like it this way. Before I was using a trick and was loading CODE through IP instead of hostname. It was working somehow, but now I’ve got it running on appliance that only allows HTTPS, so I can’t run it through IP because SSL certificate won’t match.

---

<div class="post-metadata">

**Author:** ![eugenem](https://avatars.discourse-cdn.com/v4/letter/e/3be4f8/32.png) [@eugenem](https://forum.collaboraonline.com/u/eugenem)\
**Post date:** [October 12, 2021, 2:30pm UTC](https://forum.collaboraonline.com/t/iframe-frame-ancestors-issue/649/2 "2021-10-12T14:30:22Z")

</div>

for example, this one works:  
[http://192.168.31.3:9980/loleaflet/a8b6ed2/loleaflet.html?WOPISrc=http://sl-test.hermonlabs.com:54321/wopi/files/56248](http://192.168.31.3:9980/loleaflet/a8b6ed2/loleaflet.html?WOPISrc=http://sl-test.hermonlabs.com:54321/wopi/files/56248)

and here it’s using: frame-ancestors 192.168.31.3:\* [sl-test.hermonlabs.com](http://sl-test.hermonlabs.com):\*