The Iframe embedding feature enables trusted external websites to embed pages from your site. For example, add the origin of a trusted external website, such as a partner portal, to the permitted list to display your content. By default, Source CMS blocks other websites when they attempt to embed the pages of your site in an iframe. This default behavior protects your site against clickjacking attacks. Use this document to configure permitted origins, review the validation rules for these origins, and manage external access.

Prerequisites

Ensure that you meet the following prerequisites:

• You must have the Administrator role.
• Content Security Policy (CSP) headers must be enabled on your site.
  Note

  Source CMS enables CSP headers by default on all sites. If the form displays a warning that security headers are disabled and cannot save, contact Acquia Support to re-enable the CSP on your site.

Content Security Policy header updates

To enable external access, Source CMS applies the permitted origins to the frame-ancestors directive in the CSP header of the site. This header specifies the origins permitted to embed your site in an iframe, object, or embed element. The directive always includes self for your own site and any origins you add through the form. 

•  For example, after you add https://www.example.com, the header sent to browsers contains the following directive: 

Content-Security-Policy: frame-ancestors 'self' https://www.example.com

Changes take effect immediately across your site after you save the configuration.

Validation rules

The form validates each entered origin:

If an entry fails validation, the form displays an error and does not save the changes.

If an external site cannot embed your pages after you save a valid origin, do the following:

• Ensure that the origin scheme, hostname, and port match the external site exactly.
• Ensure that you exclude trailing slashes or paths.
• Ensure that other security policies on the external site do not block the connection.

Configuring permitted origins

To enable external websites to embed your pages, add their origins to the permitted list. Source CMS always permits your own site to embed its own pages. 

To configure permitted origins:

1. Access your site.
2. In the left sidebar, click Configuration.
3. From the Configuration menu, select System.
4. Select Iframe embedding. 
5. In the Allowed embedding origins text area, enter one origin per line.
6. Include the scheme for each origin. 
   • Each origin must include the scheme (https://). For example, https://www.example.com.
   • To enable subdomain wildcards, use the *. prefix. For example, https://*.example.com.  

   • To enable only your own site, leave the text area empty. Do not add your own site to the list.

     To review all formatting requirements, refer to the Validation rules section.

7. Click Save configuration.
   Note

   If previously saved origins disappear at a later time, another administrator directly modified the Security Kit settings and the system overwrote your origins. To resolve this issue, ensure that you have the Administrator role and re-enter the origins in the form. 

Removing an origin

To revoke embedding permission for a previously permitted origin:

1. Access your site.
2. In the left sidebar, click Configuration.
3. From the Configuration menu, select System.
4. Select Iframe embedding. 
5. In the Allowed embedding origins text area, delete the lines or lines for the origins.
6. Click Save configuration.

Configuring iframe embedding

Content-Security-Policy: frame-ancestors 'self' https://www.example.com