starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 17:35:52 +03:00

[GH-ISSUE #1183] How to set per domain options to allow to put something in an iframe #967

New issue

Closed

opened 2026-02-26 06:35:15 +03:00 by kerem · 3 comments

kerem commented

2026-02-26 06:35:15 +03:00

Owner

Originally created by @erikthegamer1242 on GitHub (Jun 17, 2021).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1183

Sorry for being dumb, but how can I edit the configs per domain to set X frames to allowall because I can't log in to some sites(local WebUIs) to put them in an iframe. Or at least be able to tell the nginx that it can allowall from my webserver where the iframes are served

Originally created by @erikthegamer1242 on GitHub (Jun 17, 2021). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/1183 Sorry for being dumb, but how can I edit the configs per domain to set X frames to allowall because I can't log in to some sites(local WebUIs) to put them in an iframe. Or at least be able to tell the nginx that it can allowall from my webserver where the iframes are served

kerem closed this issue

2026-02-26 06:35:15 +03:00

kerem commented

2026-02-26 06:35:15 +03:00

Author

Owner

@chaptergy commented on GitHub (Jun 18, 2021):

One additional thing: For some browsers the X-Frame-Options header is not sufficient, you will need the Content-Security-Policy header.

Two options:

Use the advanced tab. Add something like the following:

location / {
  # Force SSL
  include conf.d/include/force-ssl.conf;
  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security "max-age=63072000;includeSubDomains; preload" always;
  add_header X-Frame-Options "ALLOW-FROM www.domain.com";
  add_header Content-Security-Policy "frame-ancestors www.domain.com";
  # Proxy!
  include conf.d/include/proxy.conf;
}

This however prevents you from using the toggles with HSTS and such on the main page and ssl page, so you would have to add those headers manually, as is already included in the above snippet.

Add a custom location for this, where you repeat hostname and port of where you want to redirect, click on the cog and add the add_header commands there. However this also prevents the toggle values from being used, as in 1., so make sure you add every header you need (e.g. HSTS) as in 1.

@chaptergy commented on GitHub (Jun 18, 2021): One additional thing: For some browsers the `X-Frame-Options` header is not sufficient, you will need the [`Content-Security-Policy`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) header. Two options: 1. Use the advanced tab. Add something like the following: ```nginx location / { # Force SSL include conf.d/include/force-ssl.conf; # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years) add_header Strict-Transport-Security "max-age=63072000;includeSubDomains; preload" always; add_header X-Frame-Options "ALLOW-FROM www.domain.com"; add_header Content-Security-Policy "frame-ancestors www.domain.com"; # Proxy! include conf.d/include/proxy.conf; } ``` This however prevents you from using the toggles with `HSTS` and such on the main page and ssl page, so you would have to add those headers manually, as is already included in the above snippet. 2. Add a custom location for this, where you repeat hostname and port of where you want to redirect, click on the cog and add the `add_header` commands there. However this also prevents the toggle values from being used, as in 1., so make sure you add every header you need (e.g. `HSTS`) as in 1. ![image](https://user-images.githubusercontent.com/26956711/122528287-aa945e80-d00b-11eb-8368-8db4a10fa2a4.png)

kerem commented

2026-02-26 06:35:15 +03:00

Author

Owner

@Tobstr02 commented on GitHub (May 4, 2023):

Got this problem again here in 2023.
Version v2.9.19

I tried to fix it with the 2 options above from @chaptergy, but it didn't changed anything.
The new header will be sent out, but as an 2nd content-policy header. So the first one with frame-src 'self' etc. will be used from my browser:

HTTP/2 200 OK
server: openresty
date: Thu, 04 May 2023 22:33:39 GMT
content-type: text/html;charset=utf-8
referrer-policy: no-referrer
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
x-robots-tag: none
cache-control: no-cache
x-content-type-options: nosniff
content-security-policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
x-xss-protection: 1; mode=block
content-language: en
x-frame-options: ALLOW-FROM ###mydomain###
content-security-policy: frame-ancestors ###mydomain###

Content Security Policy: The page settings have blocked loading a resource on https://mydomain/realms/master/protocol/openid-connect/3p-cookies/step1.html ("frame-src").

Is there something i can change to disable the content-security-policy header for that host?

@Tobstr02 commented on GitHub (May 4, 2023): Got this problem again here in 2023. Version v2.9.19 I tried to fix it with the 2 options above from @chaptergy, but it didn't changed anything. The new header will be sent out, but as an 2nd content-policy header. So the first one with frame-src 'self' etc. will be used from my browser: ``` HTTP/2 200 OK server: openresty date: Thu, 04 May 2023 22:33:39 GMT content-type: text/html;charset=utf-8 referrer-policy: no-referrer x-frame-options: SAMEORIGIN strict-transport-security: max-age=31536000; includeSubDomains x-robots-tag: none cache-control: no-cache x-content-type-options: nosniff content-security-policy: frame-src 'self'; frame-ancestors 'self'; object-src 'none'; x-xss-protection: 1; mode=block content-language: en x-frame-options: ALLOW-FROM ###mydomain### content-security-policy: frame-ancestors ###mydomain### ``` `Content Security Policy: The page settings have blocked loading a resource on https://mydomain/realms/master/protocol/openid-connect/3p-cookies/step1.html ("frame-src").` Is there something i can change to disable the content-security-policy header for that host?

kerem commented

2026-02-26 06:35:15 +03:00

Author

Owner

@nickelswitte commented on GitHub (May 7, 2023):

I have exactly the same problem. The headers just duplicate and it seems like the browser just takes the other one

´´´
HTTP/2 200 OK
server: openresty
date: Sun, 07 May 2023 10:32:39 GMT
content-type: text/html
content-encoding: gzip
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob:; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none'
referrer-policy: same-origin
permissions-policy: interest-cohort=()
x-frame-options: ALLOW-FROM my.do.main
content-security-policy: frame-ancestors my.do.main
X-Firefox-Spdy: h2
´´´

For another of my pages this works well, but that is because it does not send those two headers itself. Not quite sure how to fix this. It is possible to append the existing headers? Some guidance would be nice :)

@nickelswitte commented on GitHub (May 7, 2023): I have exactly the same problem. The headers just duplicate and it seems like the browser just takes the other one ´´´ HTTP/2 200 OK server: openresty date: Sun, 07 May 2023 10:32:39 GMT content-type: text/html content-encoding: gzip **x-frame-options: sameorigin** x-xss-protection: 1; mode=block x-content-type-options: nosniff **content-security-policy: default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:;** connect-src 'self'; manifest-src 'self'; media-src 'self' blob:; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none' referrer-policy: same-origin permissions-policy: interest-cohort=() **x-frame-options: ALLOW-FROM my.do.main** **content-security-policy: frame-ancestors my.do.main** X-Firefox-Spdy: h2 ´´´ For another of my pages this works well, but that is because it does not send those two headers itself. Not quite sure how to fix this. It is possible to append the existing headers? Some guidance would be nice :)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#967

No description provided.

Rows
Columns