Iframe slide google in Jhipster app is blocked

user_2623854 0
Viewed 153

I use JHipster 6.9.1 generator. I insert Google slide iframe in a component :

<div>
       <br><br><br>
       <iframe src="https://docs.google.com/presentation/d/e/XXX/embed?start=false&loop=false&delayms=3000" frameborder="0" width="640" height="389" allowfullscreen="true" mozallowfullscreen="true" webkitallowfullscreen="true"></iframe>
   </div>

The slider is well displayed when I use localhost:9000 , but not when I use localhost:8080 ( the Slider is blocked). I haven't log error :-s just :

Ce contenu est bloqué. Pour résoudre le problème, contactez le propriétaire du site.

I try :

slider():SafeResourceUrl {
    return this.sanitizer.bypassSecurityTrustResourceUrl("https://docs.google.com/presentation/d/e/XXX/embed?start=false&loop=false&delayms=3000");
  }

 <iframe iframe [src]='slider()'  frameborder="0" width="640" height="389" allowfullscreen="true" mozallowfullscreen="true" webkitallowfullscreen="true"></iframe>

With the same error.

Thanks for help

google-slides content-security-policy jhipster iframe
1 Answers

Resolve in contentSecurityPolicy (WebSecurityConfigurerAdapter class extend):

  @Override
    public void configure(HttpSecurity http) throws Exception {
        // @formatter:off
        http
            .csrf()
            .disable()
            .addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class)
            .exceptionHandling()
                .authenticationEntryPoint(problemSupport)
                .accessDeniedHandler(problemSupport)
        .and()
            .headers()
            .contentSecurityPolicy("script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:")
        .and() ...

thanks @Gaël Marziou

user_26238540
Related