CODEWITHSUNDEEP
djangoiframedjango-csp
gks
gks

Reputation: 261

How to use CSP_FRAME_ANCESTORS header in Django project?

I'm looking to load a Django site of my design into an iframe. For this, I added the following lines in my Django settings.py file:

MIDDLEWARE = [
          ...
    'csp.middleware.CSPMiddleware', 
        ...
]

            . . .
CSP_FRAME_ANCESTORS = ("'self'", 'localhost:*')

So that I can load my site from any address of my localhost. However, when I load my site at the following url:http://localhost:3000/searchEngine I get in the devtools inspector the following error:

 Refused to frame 'https://gkwhelps.herokuapp.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' localhost:*".

I tried to find the solution on this stack overflow question, on this blog, also on another blog on the internet and again on this blog and tried to replace CSP_FRAME_ANCESTORS by CSP_FRAME_SRC like this:

CSP_FRAME_SRC = ["'self'", 'localhost:*'] #instead of CSP_FRAME_ANCESTORS = ("'self'", 'localhost:*')

but that didn't solve the problem and the header was even ignored. I also tried to fix this by changing my setting to CSP_FRAME_ANCESTORS like this:

CSP_FRAME_ANCESTORS = ("'self'", 'http://localhost:3000/searchEngine')

Now I get the following error:

Refused to frame 'https://gkwhelps.herokuapp.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' http://localhost:3000/searchEngine".

I don't know where my fault is. Yet, I defined exactly the port 3000 and the route searchEngine used by the localhost to contain the site in the iframe.

Upvotes: 2

Views: 716

Answers (0)

Related Questions