mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-07-17 13:43:50 +03:00
Refused to display 'https://accounts.google.com/' in a frame because it set 'X-Frame-Options' to 'deny' #3933
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @namannj46 on GitHub (Jul 26, 2023).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I have integrated Bookstack in our Website with using iframe. so bookstack is opening through iframe but when i tried to login on bookstack through google login it is showing the error.
accounts.google.com is refused to connect
When i inspect the code and check the error it is showing :
Refused to display 'https://accounts.google.com/' in a frame because it set 'X-Frame-Options' to 'deny'
So please help how i can resolve this error on Bookstack
Exact BookStack Version
v23.05.2
Log Content
No response
PHP Version
No response
Hosting Environment
ubuntu 22.04
@ssddanbrown commented on GitHub (Jul 26, 2023):
This is a security control that Google are setting, not really something that can be worked around from a BookStack point of view. Many websites will block use in an iFrame due to security concerns.
@namannj46 commented on GitHub (Jul 26, 2023):
Can you suggest the possible way to do google login inside the iframe ?
@ssddanbrown commented on GitHub (Jul 26, 2023):
No, not really anything with Google direct.
You could maybe find an alternative auth platform, which does not prevent (or can be hacked to allow) iframe use, that can use google as an upstream auth provider itself, then use that with BookStack.
These are not paths I'd suggest or can recommended further on though, these limits are in place for security, and iframes as a bunch of troubles (They can also complicate cookies and visuals).
@ssddanbrown commented on GitHub (Aug 2, 2023):
Since there's been no follow-up I'm going to close this.
@ForkInABlender commented on GitHub (Feb 25, 2024):
welp, then the html used isn't the problem then and the issue is not fixed.