Is it possible to set an "ALLOW-FROM" for iframe

s_bastienchante · ‎06-28-2017

Hi,

We have an edge encryption proxy which work on another port than the 443 due to security constraint.

This configuration generate white screens because some redirection in iframe are not the same "domain:port".

The glide.set_x_frame_options properties allow to authorize other domain:port but it's considered as a medium risk

https://hi.service-now.com/kb_view.do?sysparm_article=KB0550654#10.2

My question is : Is Service Now manage an "ALLOW-FROM" properties which could authorize others specifics URL for iframe content ?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Note :

The link https://community.servicenow.com/thread/177764 indicates that it's not possible but it's an old post.

Regards,

Sébastien

Shiva Thomas · ‎06-28-2017

Hi Sébastien,

There is a System Properties called glide.set_x_frame_options

Its definition may be relevant to your case:

Enables this property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks by ensuring that their content is not embedded into other sites.

https://developer.mozilla.org/en/the_x-frame-options_response_header

It can be set here:

https://YOURINSTANCENAME.service-now.com/nav_to.do?uri=sys_properties.do?sys_id=6a80a123ff2010003061...

It's a true/false field, so there is not much control for granularity.

I did not find any other settings for relevant to Frames.

View solution in original post

pavanm_now_ · ‎11-06-2019

The allow-from option for X-Frame-Origin has become obsolete in the HTTP standards.

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Pavan
Product Security | ServiceNow

VirmaniS · ‎11-29-2019

@pavanm(now) : Please could you confirm then how to authorize published report of servicenow to be accessible in iframe to external site. I need to include it on a confluence page. Provided in iframe url, the report isnt loading.

Peter Bodifee · ‎12-12-2019

I have a similar requirement.

BTW I tried to set glide.set_x_frame_options to false on my personal dev instance (logged in as admin) and I can't even change the value.

danb2015 · ‎12-12-2019

Peter, under your admin account name in the top right, click on the menu and select "Elevate Roles" and then you will have the authority to change that to false.