External site (embeded) OIDC login

[mononym]

Hello.

For ease of use I wanted to embed some cloudron apps (Miniflux, Linkwarden, Etherpad) into the nextcloud interface. First, I embed them with the NC external-sites app. Then, I set the frame-ancestors nextcloud.domain.com; in the security settings for each app.

That all works fine until a user wants to log in to these apps. The apps display correctly, but when hitting the OIDC login button, it is impossible to log in to them.

Firefox Can’t Open This Page

To protect your security, my.domain.com will not allow Firefox to display the page if another site has embedded it. To see this page, you need to open it in a new window.

Beeing able to resolve this would also make it possible to embed the Cloudron dashboard as external site to Nextcloud, easily giving access to a repository of all apps as well.

Thanks.

[joseph]

I guess this is more a feature request, will move it. The OIDC page does not allow itself to be embedded in other pages for security purposes. Is there any other OIDC provider / login provider which allows their page to be embedded in other websites?

[mononym]

I honestly don't know, what is the underlying OIDC system of Cloudron ? It is not properly speaking 'embedding', only accepting the login requests from apps which are embedded in another site, all hosted on Cloudron, if that makes sense ?

[nebulon]

So currently the login flow pages are served up with content security policy headers to not allow being embedded in another domain/origin. The reason for this is to prevent clickjacking attacks and was explicitly done that way.

I guess for this we would need a csp setting for the OpenID provider where one can allow specific domains/origins.