Log into wordpress accounts within iframe

Viewing 5 replies - 16 through 20 (of 20 total)
1 2
  • Thread Starter delanthear

    (@delanthear)

    5 years, 7 months ago

    I did the following to get a specific site allowed to view my logged in pages:

    1) In functions.php added:

    add_action( 'send_headers', 'add_header_xua' );
function add_header_xua() {
	header( 'Content-Security-Policy: frame-ancestors http://sitethatisbeingloaded.url/ http://sitethatisdoingtheloading.url/' );
}

    2) In functions.php added: 

    add_action('wp_head', 'iframe_load_setup');
function iframe_load_setup() {	
        // If this is the iframe login page, remove the headers
	if ( is_page('***pagename I wanted the iframe login to work on***') ) {
		remove_action( 'login_init', 'send_frame_options_header', 10, 0 );		
	}
}

    This section action meant that the login_init action send_frame_options_header was removed it the login was taking place on a particular page. This means the protection for crosssite loading is only removed on that page. If you wanted your whole site to be loadable, you could just generally remove the action I think.

    • This reply was modified 5 years, 7 months ago by delanthear.
    kelsjc

    (@kelsjc)

    5 years, 7 months ago

    Hi all
    I put this mentioned code on my functions.php and I got the following error:

    Refused to frame ‘https://mydomain.com/’ because an ancestor violates the following Content Security Policy directive: “frame-ancestors FULL-URL”.

    How can I solve this?

    Thanks

    kelsjc

    (@kelsjc)

    5 years, 7 months ago

    @delanthear all this code you put on the functions.php in iframed site, right?
    The domain is repeated twice on the first part?
    IS this URL from the MAIN site or IFRAMED one?

    I’m getting conection refused anyway :/

    Any idea?

    • This reply was modified 5 years, 7 months ago by kelsjc.
    • This reply was modified 5 years, 7 months ago by kelsjc.
    kelsjc

    (@kelsjc)

    5 years, 7 months ago

    @delanthear check this scenario and let me know if it’s correct

    WP1 — (iframed WP2)

    On theme/functions.php in WP2

    add_action( 'send_headers', 'add_header_xua' );
function add_header_xua() {
	header( 'Content-Security-Policy: frame-ancestors http://WP2/page' );
} 

add_action('wp_head', 'iframe_load_setup');
function iframe_load_setup() {	
        // If this is the iframe login page, remove the headers
	if ( is_page('WP2_PAGE_SLUG') ) {
		remove_action( 'login_init', 'send_frame_options_header', 10, 0 );		
	}
}
    Thread Starter delanthear

    (@delanthear)

    5 years, 7 months ago

    Yeah, you don’t need anything on the site that has the iframe in. All that is doing is trying to load a page.

    You need to change this line:
    header( 'Content-Security-Policy: frame-ancestors http://WP2/page' );

    If the page with the iframe is called http://www.foo.com and the page where it is loading the content from is called http://www.bar.com, that line needs to be:

    header( 'Content-Security-Policy: frame-ancestors http://www.bar.com/ http://www.foo.com/' );

    • This reply was modified 5 years, 7 months ago by delanthear.
Viewing 5 replies - 16 through 20 (of 20 total)
1 2

The topic ‘Log into wordpress accounts within iframe’ is closed to new replies.