Blocked by Content Security Policy

Do you have any plugins activated? Can you grab the HTTP response headers from the iframe preview request and share?

That’s really strange. And you’re accessing the customizer via http://local.wp_beta.com/wp-admin/customize.php in your browser?

The response header looks right:

Content-Security-Policy: frame-ancestors http://local.wp_beta.com

Firefox is loading the iframe as expected for me with the following response headers (served via Nginx on VVV):

Cache-Control: no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Security-Policy: frame-ancestors http://src.wordpress-develop.dev
Content-Type: text/html; charset=UTF-8
Date: Sat, 29 Oct 2016 17:40:25 GMT
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Link: <http://src.wordpress-develop.dev/wp-json/>; rel="https://api.w.org/", <http://src.wordpress-develop.dev/>; rel=shortlink
Server: nginx
Transfer-Encoding: chunked
X-Frame-Options: ALLOW-FROM http://src.wordpress-develop.dev/wp-admin/customize.php
X-Robots: noindex, nofollow, noarchive

And I’m accessing the customizer via http://src.wordpress-develop.dev/wp-admin/customize.php.

I am only able to get Firefox to display the same CSP error message if I change the Content-Security-Policy header to send back a different domain, like frame-ancestors http://example.com.

Does the iframe load as expected when you comment-out the following line in \WP_Customize_Manager::filter_iframe_security_headers() in class-wp-customize-manager.php?

$headers['Content-Security-Policy'] = 'frame-ancestors ' . preg_replace( '#^(\w+://[^/]+).+?$#', '$1', $customize_url );

I’m testing this in Firefox 49.0.2. Which version are you testing with?

Any support you can provide with troubleshooting the reason as to why your Firefox is failing the CSP would be extremely appreciated since I cannot reproduce the issue, and the issue is unique to your environment as far as I know.

• This reply was modified 8 years, 1 month ago by Weston Ruter.

Thank you. As a fallback if we can’t figure out why Firefox is rejecting the iframe request, then the CSP header could be overridden to be removed entirely. I originally included it to override any other plugins that may have added the header to prevent their site from being iframed. But instead of specifying frame-ancestors as its value, the entire header could be removed instead if we also then include a preview nonce among the customized state query params. Nevertheless, if we can figure out why Firefox is rejecting it that would be best.

Didn’t want to resurrect this topic, I ran into this issue and spent right around 7-8 hours trying to diagnose this. Tried websevendevs solution, Caused Apache2 to generate errors and return a Error 500 on any page.

Here is what I found out and did:
– The headers module was not enabled. I had to enable this module by typing:

sudo a2enmod headers.load then sudo service apache2 restart

– I went into /etc/apache2/conf-available/security.conf and then added the line websevendev mentioned.

Header set Content-Security-Policy: "frame-ancestors 'self'"

Now it’s fixed for all of my WordPress VirtualHosts. I am actually surprised that Apache doesn’t set this as default because it does set script-src to self and object-src to self. I don’t see any implications of this setting so far.

• This reply was modified 7 years, 6 months ago by brekmister. Reason: Made it easier to read
• This reply was modified 7 years, 6 months ago by brekmister. Reason: Specified path for security.conf