[External] Setting properties int the IdP to empty strings

[Robinson, Justin S]

It depends on how fine grained you want to get in the process. The allow-from is deprecated and not supported in most current browsers. There are also levels of precedence depending on the browser when both x-frame-options and content-security-policy are in place. In many browsers, the content-security-policy will have higher precedence than x-frame-options if both are applied. There is an option in content-security-policy to apply specific domains allowed without flipping the switch entirely. It can be used in conjunction with x-frame-options with that caveat some browsers will apply x-frame-options first if used together (Safari is one example).

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors

Justin Robinson
Manager, Identity Management Systems
 
2709 East 10th Street
Bloomington, IN 47408
812.855.3264 tel
jr72 at iu.edu <mailto:jr72 at iu.edu>

> On Mar 29, 2021, at 2:10 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
> 
> This message was sent from a non-IU address. Please exercise caution when clicking links or opening attachments from external sources.
> -------
> 
> For my second silly question of the day...
> 
> If I want to allow my IdP to be loaded in an iframe, throwing caution and clickjacking protection to the wind, can I just add this to idp.properties:
> 
> idp.frameoptions =
> 
> 
> That's what I had in V3, but it doesn't seem to be working in V4 unless there's some other craziness going on.
> 
> Alternatively, it looks like x-frame-options supports an allow-from option if I just want certain sites (our LMSes that are using our media sharing service in a frame) to be able to do this, is that allow-from actually well supported by browsers? If I want to allow from multiple domains, what would that look like in the IdP's configuration?
> 
> Keith
> 
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210329/12ca61dd/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4047 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210329/12ca61dd/attachment.p7s>