[GH-ISSUE #23] Raw message tab is broken because of cross-origin access

kerem commented

2026-03-15 12:08:10 +03:00

Owner

Originally created by @antonkomarev on GitHub (Nov 22, 2022).
Original GitHub issue: https://github.com/axllent/mailpit/issues/23

Loading «https://mailpit.example.com/api/v1/message/89db0f92-a94b-4e43-80f1-d25866d7e1e5/raw» in frame prohibited by directive «X-Frame-Options», setted as «DENY».
DOMException: Permission denied to access property "document" on cross-origin object

Firefox:
Screenshot 2022-11-22 at 15 39 36

Chrome:

Originally created by @antonkomarev on GitHub (Nov 22, 2022). Original GitHub issue: https://github.com/axllent/mailpit/issues/23 Loading «https://mailpit.example.com/api/v1/message/89db0f92-a94b-4e43-80f1-d25866d7e1e5/raw» in frame prohibited by directive «X-Frame-Options», setted as «DENY». DOMException: Permission denied to access property "document" on cross-origin object Firefox: <img width="1440" alt="Screenshot 2022-11-22 at 15 39 36" src="https://user-images.githubusercontent.com/1849174/203305286-b81fcce0-259a-4859-98ac-1ae5fc6076d2.png"> Chrome: ![2022-11-22 15 37 06](https://user-images.githubusercontent.com/1849174/203304962-9783840a-8c80-4451-8abb-dcd141f198c4.jpg)

kerem closed this issue

2026-03-15 12:08:16 +03:00

kerem commented

2026-03-15 12:08:22 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 22, 2022):

In Firefox there is a button to open link in new tab (and it works), but in Chrome you are stuck on error message without any way to see raw content.

@antonkomarev commented on GitHub (Nov 22, 2022): In Firefox there is a button to open link in new tab (and it works), but in Chrome you are stuck on error message without any way to see raw content.

kerem commented

2026-03-15 12:08:27 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 22, 2022):

It looks like raw messages should be opened on a new tab all the time.

@antonkomarev commented on GitHub (Nov 22, 2022): It looks like raw messages should be opened on a new tab all the time.

kerem commented

2026-03-15 12:08:32 +03:00

Author

Owner

@axllent commented on GitHub (Nov 22, 2022):

The raw messages comes from the same origin so is allowed by the permissions. It works fine in both Firefox and Chrome here. Are you sure it isn't the same issue you're having with your extensions you mentioned in #24 ?

@axllent commented on GitHub (Nov 22, 2022): The raw messages comes from the same origin so is allowed by the permissions. It works fine in both Firefox and Chrome here. Are you sure it isn't the same issue you're having with your extensions you mentioned in #24 ?

kerem commented

2026-03-15 12:08:37 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 22, 2022):

Yes, I'm sure, we tested it on different browsers and machines. These screenshots are from different people

@antonkomarev commented on GitHub (Nov 22, 2022): Yes, I'm sure, we tested it on different browsers and machines. These screenshots are from different people

kerem commented

2026-03-15 12:08:42 +03:00

Author

Owner

@axllent commented on GitHub (Nov 23, 2022):

The HTTP server only sends the following header:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src * data: blob:; font-src 'self' data:; media-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self';

This says frame-src 'self'; meaning iframes can be loaded from the same domain as you are accessing Mailpit from, eg: https://mailpit.example.com/api/v1/message/89db0f92-a94b-4e43-80f1-d25866d7e1e5/raw should be allowed to load from https://mailpit.example.com/#89db0f92-a94b-4e43-80f1-d25866d7e1e5.

Your error message:

in frame prohibited by directive «X-Frame-Options», setted as «DENY».
DOMException: Permission denied to access property "document" on cross-origin object

seems to imply that X-Frame-Options is being set somewhere, but it's not, or rather not from Mailpit. Are you using some HTTP proxy to access Mailpit? I need more information from you:

Are you using a proxy? If yes, then this probably is where your problem is as it appears it is adding additional security headers which is blocking the requests in your browser.
If not, then please provide me more information:
a) the Mailpit version you are running?
b) how is it currently set up in your network?
c) I would like to see the browser's response headers from the Mialpit server (from the landing page, eg : https://mailpit.example.com/).

@axllent commented on GitHub (Nov 23, 2022): The HTTP server only sends the following header: ``` Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src * data: blob:; font-src 'self' data:; media-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self'; ``` This says `frame-src 'self';` meaning iframes can be loaded from the same domain as you are accessing Mailpit from, eg: `https://mailpit.example.com/api/v1/message/89db0f92-a94b-4e43-80f1-d25866d7e1e5/raw` should be allowed to load from `https://mailpit.example.com/#89db0f92-a94b-4e43-80f1-d25866d7e1e5`. Your error message: ``` in frame prohibited by directive «X-Frame-Options», setted as «DENY». DOMException: Permission denied to access property "document" on cross-origin object ``` seems to imply that `X-Frame-Options` is being set somewhere, but it's not, or rather not from Mailpit. Are you using some HTTP proxy to access Mailpit? I need more information from you: 1. Are you using a proxy? If yes, then this probably is where your problem is as it appears it is adding additional security headers which is blocking the requests in your browser. 2. If not, then please provide me more information: a) the Mailpit version you are running? b) how is it currently set up in your network? c) I would like to see the browser's response headers from the Mialpit server (from the landing page, eg : `https://mailpit.example.com/`).

kerem commented

2026-03-15 12:08:47 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 29, 2022):

Mailpit 1.2.9

Response headers:

HTTP/2 200 OK
server: nginx/1.23.2
date: Tue, 29 Nov 2022 09:55:43 GMT
content-type: text/html; charset=utf-8
content-length: 359
accept-ranges: bytes
content-encoding: gzip
content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src * data: blob:; font-src 'self' data:; media-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self';
referrer-policy: no-referrer
x-frame-options: DENY
x-xss-protection: 1; mode=block
X-Firefox-Spdy: h2

@antonkomarev commented on GitHub (Nov 29, 2022): Mailpit 1.2.9 Response headers: ``` HTTP/2 200 OK server: nginx/1.23.2 date: Tue, 29 Nov 2022 09:55:43 GMT content-type: text/html; charset=utf-8 content-length: 359 accept-ranges: bytes content-encoding: gzip content-security-policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src * data: blob:; font-src 'self' data:; media-src 'self'; connect-src 'self' ws: wss:; object-src 'none'; base-uri 'self'; referrer-policy: no-referrer x-frame-options: DENY x-xss-protection: 1; mode=block X-Firefox-Spdy: h2 ```

kerem commented

2026-03-15 12:08:52 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 29, 2022):

Mailpit is hidden behind nginx proxy

location ~ /api/events {
      proxy_pass http://mailpit-01-backend;
      proxy_set_header      Host $host;
      # websocket support
      proxy_http_version    1.1;
      proxy_set_header      Upgrade $http_upgrade;
      proxy_set_header      Connection "Upgrade";
      proxy_read_timeout    86400;
}

location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Server $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_pass http://mailpit-01-backend;
      proxy_connect_timeout       120;
      proxy_send_timeout          120;
      proxy_read_timeout          120;
      send_timeout                120;
}

And we have global security policy:

add_header X-Frame-Options "DENY";

@antonkomarev commented on GitHub (Nov 29, 2022): Mailpit is hidden behind nginx proxy ``` location ~ /api/events { proxy_pass http://mailpit-01-backend; proxy_set_header Host $host; # websocket support proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; proxy_read_timeout 86400; } location / { proxy_set_header Host $http_host; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://mailpit-01-backend; proxy_connect_timeout 120; proxy_send_timeout 120; proxy_read_timeout 120; send_timeout 120; } ``` And we have global security policy: ``` add_header X-Frame-Options "DENY"; ```

kerem commented

2026-03-15 12:08:57 +03:00

Author

Owner

@axllent commented on GitHub (Nov 29, 2022):

I believe you have answered your own question. Your global policy (X-Frame-Options "DENY";) is what is blocking any iframe from loading anywhere. Mailpit requires an iframe to render the email HTML and raw email, and does it not require (or use) cross-origin to do so (it loads from the same host/domain). This isn't a limitation or anything broken in Mailpit, but an enforced limitation in your global policy, so there isn't anything i can do about it unfortunately. You will need to relax your policy to at least be able to load iframes from the same host.

@axllent commented on GitHub (Nov 29, 2022): I believe you have answered your own question. Your global policy (`X-Frame-Options "DENY";`) is what is blocking **any** iframe from loading anywhere. Mailpit requires an iframe to render the email HTML and raw email, and does it not require (or use) cross-origin to do so (it loads from the same host/domain). This isn't a limitation or anything broken in Mailpit, but an enforced limitation in your global policy, so there isn't anything i can do about it unfortunately. You will need to relax your policy to at least be able to load iframes from the same host.

kerem commented

2026-03-15 12:09:02 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 30, 2022):

Sent this thread to our devops team, will return with feedback.

@antonkomarev commented on GitHub (Nov 30, 2022): Sent this thread to our devops team, will return with feedback.

kerem commented

2026-03-15 12:09:07 +03:00

Author

Owner

@antonkomarev commented on GitHub (Nov 30, 2022):

Fixed by changing

add_header X-Frame-Options "DENY";

to

add_header X-Frame-Options "SAMEORIGIN";

@antonkomarev commented on GitHub (Nov 30, 2022): Fixed by changing ``` add_header X-Frame-Options "DENY"; ``` to ``` add_header X-Frame-Options "SAMEORIGIN"; ```

Rows
Columns

[GH-ISSUE #23] Raw message tab is broken because of cross-origin access #20