The Iframe embedding feature enables trusted external websites to embed pages from your site. For example, add the origin of a trusted external website, such as a partner portal, to the permitted list to display your content. By default, Source CMS blocks other websites when they attempt to embed the pages of your site in an iframe. This default behavior protects your site against clickjacking attacks. Use this document to configure permitted origins, review the validation rules for these origins, and manage external access.
Prerequisites
Ensure that you meet the following prerequisites:
You must have the Administrator role.
Content Security Policy (CSP) headers must be enabled on your site.
Note
Source CMS enables CSP headers by default on all sites. If the form displays a warning that security headers are disabled and cannot save, contact Acquia Support to re-enable the CSP on your site.
Content Security Policy header updates
Configuring iframe embedding
The Iframe embedding feature enables trusted external websites to embed pages from your site. For example, add the origin of a trusted external website, such as a partner portal, to the permitted list to display your content. By default, Source CMS blocks other websites when they attempt to embed the pages of your site in an iframe. This default behavior protects your site against clickjacking attacks. Use this document to configure permitted origins, review the validation rules for these origins, and manage external access.
Prerequisites
Ensure that you meet the following prerequisites:
You must have the Administrator role.
Content Security Policy (CSP) headers must be enabled on your site.
Note
Source CMS enables CSP headers by default on all sites. If the form displays a warning that security headers are disabled and cannot save, contact Acquia Support to re-enable the CSP on your site.
Content Security Policy header updates
To enable external access, Source CMS applies the permitted origins to the frame-ancestors directive in the CSP header of the site. This header specifies the origins permitted to embed your site in an iframe, object, or embed element. The directive always includes self for your own site and any origins you add through the form.
For example, after you add https://www.example.com, the header sent to browsers contains the following directive:
Changes take effect immediately across your site after you save the configuration.
Validation rules
The form validates each entered origin:
Requirement
Valid example
Invalid example
Include the https:// or http:// scheme
https://example.com
example.com
Provide a valid hostname
https://www.example.com
https://not valid.com
Use the *. prefix for subdomain wildcards
https://*.example.com
https://example.*
Exclude paths, query strings, or fragments
https://example.com
https://example.com/page
Provide an optional port from 1 to 65535
https://example.com:8080
https://example.com:0
If an entry fails validation, the form displays an error and does not save the changes.
If an external site cannot embed your pages after you save a valid origin, do the following:
Ensure that the origin scheme, hostname, and port match the external site exactly.
Ensure that you exclude trailing slashes or paths.
Ensure that other security policies on the external site do not block the connection.
Configuring permitted origins
To enable external websites to embed your pages, add their origins to the permitted list. Source CMS always permits your own site to embed its own pages.
In the Allowed embedding origins text area, enter one origin per line.
Include the scheme for each origin.
Each origin must include the scheme (https://). For example, https://www.example.com.
To enable subdomain wildcards, use the *. prefix. For example, https://*.example.com.
To enable only your own site, leave the text area empty. Do not add your own site to the list.
To review all formatting requirements, refer to the Validation rules section.
Click Save configuration.
Note
If previously saved origins disappear at a later time, another administrator directly modified the Security Kit settings and the system overwrote your origins. To resolve this issue, ensure that you have the Administrator role and re-enter the origins in the form.
Removing an origin
To revoke embedding permission for a previously permitted origin:
In the Allowed embedding origins text area, delete the lines or lines for the origins.
Click Save configuration.
To enable external access, Source CMS applies the permitted origins to the frame-ancestors directive in the CSP header of the site. This header specifies the origins permitted to embed your site in an iframe, object, or embed element. The directive always includes self for your own site and any origins you add through the form.
For example, after you add https://www.example.com, the header sent to browsers contains the following directive:
Changes take effect immediately across your site after you save the configuration.
Validation rules
The form validates each entered origin:
Requirement
Valid example
Invalid example
Include the https:// or http:// scheme
https://example.com
example.com
Provide a valid hostname
https://www.example.com
https://not valid.com
Use the *. prefix for subdomain wildcards
https://*.example.com
https://example.*
Exclude paths, query strings, or fragments
https://example.com
https://example.com/page
Provide an optional port from 1 to 65535
https://example.com:8080
https://example.com:0
If an entry fails validation, the form displays an error and does not save the changes.
If an external site cannot embed your pages after you save a valid origin, do the following:
Ensure that the origin scheme, hostname, and port match the external site exactly.
Ensure that you exclude trailing slashes or paths.
Ensure that other security policies on the external site do not block the connection.
Configuring permitted origins
To enable external websites to embed your pages, add their origins to the permitted list. Source CMS always permits your own site to embed its own pages.
In the Allowed embedding origins text area, enter one origin per line.
Include the scheme for each origin.
Each origin must include the scheme (https://). For example, https://www.example.com.
To enable subdomain wildcards, use the *. prefix. For example, https://*.example.com.
To enable only your own site, leave the text area empty. Do not add your own site to the list.
To review all formatting requirements, refer to the Validation rules section.
Click Save configuration.
Note
If previously saved origins disappear at a later time, another administrator directly modified the Security Kit settings and the system overwrote your origins. To resolve this issue, ensure that you have the Administrator role and re-enter the origins in the form.
Removing an origin
To revoke embedding permission for a previously permitted origin:
Source CMS