cliu/ci-server-engineer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

check-web-access: framed pages are fetched by the viewer's browser

Browse source 
Note: an IP allowlist on the target site must include the web-client
viewers; seen on the R1.05 test server (200 from the server, 403 from
another PC).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Clio Liu 2026-10-09 15:12:07 +11:00
parent 732c6fb2da
commit fd2666ddb1
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
.claude/skills/portal-setup/tasks/check-web-access.md
View file

@ -103,3 +103,12 @@ clients). Then the header contains `frame-src 'self' https://<allowed host>`, an
showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
these headers (not tested).
**Who loads the framed page.** In the web client the page in a web browser component is fetched
by the viewer's own browser, not by the CI Server. So besides the `frame-src` entry, the target
site must accept requests from every machine that opens the web client: a site that only admits
the CI Server's address (IP allowlist) answers 403 to the viewers and the frame stays blank or
shows an error, although the same display works in the Operator Interface on the CI Server
(there the browser runs on the server). Check from a viewer PC with `curl -I <url>`. The target
must also not forbid framing (`X-Frame-Options` or its own CSP `frame-ancestors`). Seen on the
R1.05 test server 2026-10-09: 200 from the server, 403 from another PC.