Unable to use Cloudron hosted Etherpad instance within Humhub

[shrey]

I have Humhub and Etherpad instances, both on the same Cloudron.

Have configured Etherpad module within Humhub, as per the instructions given here:
https://marketplace.humhub.com/module/notes/installation

The connection is successful:

But, when i do try to edit a Note in the Notes (Etherpad) module, i get the error:
<my-cloudron-domain> refused to connect.

Dev tools error:
Refused to frame '<my-cloudron-domain>' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".

I tried configuring the Content Security Policy property for both, Humhub and Etherpad, to include frame-ancestors 'self' <other relevant domains>,
but am still getting the same error.

How to resolve this?

[girish]

@shrey I think you have to add a custom CSP to etherpad. See https://docs.cloudron.io/apps/#custom-csp

[shrey]

@girish Tried that already (maybe incorrectly?).

@shrey said in Unable to use Cloudron hosted Etherpad instance within Humhub:
I tried configuring the Content Security Policy property for both, Humhub and Etherpad, to include frame-ancestors 'self' <other relevant domains>,
but am still getting the same error.

Have already set the custom CSP to:
frame-ancestors <humhub-domain> <my-cloudron-domain>;

[shrey]

@girish Another point of observation:

If i access Etherpad (within Humhub), when i am also logged into Cloudron in the same browser, it works.

But, if i open Humhub in another browser (say an incognito session), Etherpad doesn't work.

[girish]

@shrey etherpad needs login, no?

[shrey]

@girish i thought the API key was intended to take care of that (the authentication)

[nebulon]

etherpad does an openId authentication automatically when opened (the way its implemented in upstream openid plugin), which is why it probably works when logged in, but in an incognito tab, it should redirect you to the Cloudron login, however I don't know if this is a supported workflow in humhub

[shrey]

@nebulon that's a rather strange requirement from Etherpad: to be able to embed the app (etherpad) but still need to authenticate each user with their individual account in the originating etherpad server (despite having an API to authenticate)