Is there a way include a firefox extension popup in the Content-Security-Policy of my website? - firefox-addon

Question

I want to embed an iframe in the popup of a firefox extension but I get "Firefox Can’t Open This Page - To protect your security, www.example.com will not allow Firefox to display the page if another site has embedded it." and it is because the site example.com has configured the Content-Security-Policy with frame-ancestors 'self'. I can change it to frame-ancestors * but I would like something less broad.

Answer 1

It depends what origin your popup window has (what is specified in <iframe src= or in <iframe srcdoc=)
Some origins is a subject of CSP regulation, the other is not. For example, vendor's schemes like moz-extension: / chrome: should bypass the CSP.
Also the 'self' token can be very insidious:
,----------------- parent HTTP://example.com --------------------,
| |
| * Host-source is HTTP://example.com with the HTTP: scheme |
| |
| <iframe src='HTTPS://example.com'> |
| Content-Security-Policy: frame-ancestors 'self' |
| |
| * 'self' would be substituted by HTTPS://example.com, it |
| means that you actually have the header: |
| Content-Security-Policy: frame-ancestors HTTPS://example.com |
| therefore it will block embedding into parent with |
| HTTP://example.com because of schemes mismatch |
| (HTTP: !== HTTPS:) |
| |
| <iframe> |
|________________________________________________________________|
But the opposite situation (parent with HTTPS: and iframe with HTTP:) will not cause problems in CSP3 browsers (but will cause in CSP2 ones).

Answer 2

In case of IIS you need to change X-FRAME-OPTIONS header from "Deny" to "SAME-ORIGIN" or add the X-FRAME-OPTIONS if it does not exist. To do that:
Open IIS Manager and on the left hand tree, left click the site you would like to manage.
Doubleclick the “HTTP Response Headers” icon.
Right click the header list and select “Add”
For the “name” write “X-FRAME-OPTIONS” and for the value write in your desired option e.g. “SAME-ORIGIN”.