From fd2666ddb1bbefe6b3c501b7aac6a2c17b9fea97 Mon Sep 17 00:00:00 2001 From: cliu Date: Fri, 9 Oct 2026 15:12:07 +1100 Subject: [PATCH] check-web-access: framed pages are fetched by the viewer's browser Note: an IP allowlist on the target site must include the web-client viewers; seen on the R1.05 test server (200 from the server, 403 from another PC). Co-Authored-By: Claude Opus 5.5 --- .claude/skills/portal-setup/tasks/check-web-access.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.claude/skills/portal-setup/tasks/check-web-access.md b/.claude/skills/portal-setup/tasks/check-web-access.md index b005b42..fafab99 100644 --- a/.claude/skills/portal-setup/tasks/check-web-access.md +++ b/.claude/skills/portal-setup/tasks/check-web-access.md @@ -103,3 +103,12 @@ clients). Then the header contains `frame-src 'self' https://`, an showed inside the display with no CSP violation. List only the hosts you need; to undo, remove the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by these headers (not tested). + +**Who loads the framed page.** In the web client the page in a web browser component is fetched +by the viewer's own browser, not by the CI Server. So besides the `frame-src` entry, the target +site must accept requests from every machine that opens the web client: a site that only admits +the CI Server's address (IP allowlist) answers 403 to the viewers and the frame stays blank or +shows an error, although the same display works in the Operator Interface on the CI Server +(there the browser runs on the server). Check from a viewer PC with `curl -I `. The target +must also not forbid framing (`X-Frame-Options` or its own CSP `frame-ancestors`). Seen on the +R1.05 test server 2026-10-09: 200 from the server, 403 from another PC.