v239 loads in an iFrame but v282 will not

[bnhf]

Happy New Year! Big fan of Cockpit, and I've been using it successfully for several years in an Organizr iFrame with:

[WebService]
AllowUnencrypted = true

I recently attempted to upgrade from the version in the Debian 11 stable repository to bullseye-backports (v239 to v282), and although the AllowUnencrypted option still works, I can no longer load Cockpit in an iFrame. Is this still possible, or am I stuck on v239?

[bnhf]

A bit more information about this:

I setup a test environment to experiment with some of the other cockpit.conf options. None seemed to do the trick, however I was able to get Cockpit running in an Organizr iFrame by using the Chrome extension "Ignore X-Frame headers". Not really an ideal solution, though I did limit its access to the host computer in the form http://hostname.localdomain. However, it is confirmation that the change in Cockpit's X-Frame Options are the likely issue. So, still looking for a better solution that will work with all browsers, and doesn't require an extension to be loaded. These are the cockpit.conf options I tried:

ProtocolHeader = X-Forwarded-Proto
ForwardedForHeader = X-Forwarded-For

I used them as shown above, but I'm wondering if that's correct or if the values shown are just placeholders?

[jelly]

I believe everything is considered the SAMEORIGIN if it's server from the same domain, so assuming you proxy everything to the same domain this should work fine.

[bnhf]

@jelly

I agree, that seems like the way it should -- unfortunately it does not. As I said, all of the applications are on the same host computer and only used locally on my LAN. No proxy required, or in use. The domain is .localdomain, which I have specifically specified with no joy.

Perhaps I should turn this discussion into an "issue"? It seems to me based on your comments, that SAMEORIGIN is not functioning as intended -- so would qualify as a bug.

[jelly]

How does Organizer load cockpit? Does it load it into an iframe?

[bnhf]

@jelly

Yes, Organizr loads Cockpit (v239) in a iFrame. Here's an example of Portainer, Cockpit, Webmin, OpenVPN Admin Plus, Paperless-ngx, and phpMyAdmin all running in Organizr. What makes Organizr so useful as a "homepage" is its ability to load WebUI's in iFrames so that only one browser tab is required to utilize multiple WebUI's by server, function or whatever:

[jelly]

If the iframe loads cockpit from :9090 then that is a different origin from :443 or :80 or what organizer's port is.

[teras]

I have a similar issue. I am using Cockpit through a Custom New Tab Page firefox extension. Due to limitations of Firefox itself (as long as I understand it), it is forcing the pages that would appear in nte tab to be inside an iframe, although it tries its best at least to expose the external url on the taskbar.

So, when I am using cokcpit, although I can go to the correct URL, I have to click on the URL bar, to set the focus, then press enter, to reload the page (and get rid of the iframe) and then login to cockpit.

Is there any way to make things easier than this? Thank you!