topic Re: Loading activi-app in an iFrame in Alfresco Archive

Loading activi-app in an iFrame

mikeblum — Tue, 14 Jul 2015 18:27:18 GMT

I'm attempting to load the activiti-app into an iframe from Box.com but get blocked with the following exception:Refused to display 'https://localhost/activiti-app/workflow/#/tasks?taskId=100011' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.Configuring the CORS filter on the tomcat in

Re: Loading activi-app in an iFrame

jbarrez — Tue, 14 Jul 2015 19:38:43 GMT

yes, the current (1.2.2) version does indeed have Sameorigin, meaning that you would have to use a proxy server such that everything is running on the same domain.

The cors filter is probably not going to help, cause it's being set in the Spring SecurityConfiguration.

To solve the issue, we'd probably have to allow for configuration of the X-Frame options, but we've had some security issues with that before … which is why we set it to sameorigin.

Re: Loading activi-app in an iFrame

mikeblum — Tue, 14 Jul 2015 21:18:24 GMT

That makes sense. I tried adding a proxy to my Apache http server:

ProxyPass /activiti-app http://localhost:8080/activiti-app
ProxyPassReverse /activiti-app http://localhost:8080/activiti-app

But I'm still getting a SAMEORIGIN error. Is proxyPass not going to work?

Re: Loading activi-app in an iFrame

vasile_dirla — Wed, 15 Jul 2015 19:04:31 GMT

it seems the iframe source want to load the "https://localhost/activiti-app/" make sure you configure the proxy pass with SSL

you have to load: mod_proxy, mod_ssl and mod_proxy_http and then define the ProxyPass
<blockcode>
<VirtualHost *:443>
    SSLEngine On
    SSLProxyEngine On
    ProxyRequests Off
    SSLCertificateFile /etc/httpd/certs/yourCertificate.crt
    SSLCertificateKeyFile /etc/httpd/certs/yourKey.key
    ProxyPass /activiti-app http://localhost:8080/activiti-app
    ProxyPassReverse /activiti-app http://localhost:8080/activiti-app
</VirtualHost>
</blockcode>

Maybe you already did that but this is the first thing I have in mind considering the problem.

Re: Loading activi-app in an iFrame

mikeblum — Mon, 27 Jul 2015 20:55:06 GMT

Thanks. That's exactly what we ended up doing with an apache2 proxy.