diff --git a/.claude/skills/portal-setup/tasks/check-web-access.md b/.claude/skills/portal-setup/tasks/check-web-access.md index b005b42..fafab99 100644 --- a/.claude/skills/portal-setup/tasks/check-web-access.md +++ b/.claude/skills/portal-setup/tasks/check-web-access.md @@ -103,3 +103,12 @@ clients). Then the header contains `frame-src 'self' https://`, an showed inside the display with no CSP violation. List only the hosts you need; to undo, remove the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by these headers (not tested). + +**Who loads the framed page.** In the web client the page in a web browser component is fetched +by the viewer's own browser, not by the CI Server. So besides the `frame-src` entry, the target +site must accept requests from every machine that opens the web client: a site that only admits +the CI Server's address (IP allowlist) answers 403 to the viewers and the frame stays blank or +shows an error, although the same display works in the Operator Interface on the CI Server +(there the browser runs on the server). Check from a viewer PC with `curl -I `. The target +must also not forbid framing (`X-Frame-Options` or its own CSP `frame-ancestors`). Seen on the +R1.05 test server 2026-10-09: 200 from the server, 403 from another PC.