Modify WebUI headers

[boozel]

Hi

 

I am trying to bed my Unraid WebUi as a tab in Home Assistant. This worked perfectly on my LAN with UnRaid version 6.9 but since upgrading to version 6.10 it seems like the web server now sets the x-frame-options header to 'sameorigin'. 

 

Is there a way I can update this?

 

Thanks in advance!

 

 

[Squid]

Not without modifying the code yourself

[m4rcus]

On 6/21/2022 at 4:47 PM, Squid said:

Not without modifying the code yourself

 

coming a little late to the party but.. would that be able with a plugin/startup script?

[renedis1]

I've had this issue too. I'm using HomeAssistant LoveLace dashboard where I use iFrames for my other web interfaces.

 

For future reference:

- SSH to your Unraid server

- Open /etc/nginx/nginx.conf with vi or nano

- Go to the bottom to find add_header Content-Security-Policy "frame-ancestors 'self' https://connect.myunraid.net/"

- Edit to your liking (example): add_header Content-Security-Policy "frame-ancestors 'self' https://connect.myunraid.net/ https://ha.mydomain.net"

 

After editing you need to reload the web service of unraid:

/etc/rc.d/rc.nginx reload

 

 

Extra:

If you run a reverse proxy and/or 2FA service in your iframe you need to include these too. It is allowed to add IP addresses.

 

As an example:

add_header Content-Security-Policy "frame-ancestors 'self' https://connect.myunraid.net/ https://ha.mydomain.net 192.168.1.1 172.30.0.2"

 

Dropdown:

- Default: https://connect.myunraid.net/

- Where the iframe is used: https://ha.mydomain.net

- Reverse proxy: 192.168.1.1

- 2FA url 172.30.0.2

Edited January 7 by renedis1

[toyanucci]

I have been struggling getting this to work to load unraid in an iframe in Organizr.  The instructions above was half the battle, the other half was to add the following in chrome:

 

Open: chrome://flags/#unsafely-treat-insecure-origin-as-secure and add https://tower.mydomain.com to the list of insecure sites to allow then change the setting to enable and relaunch chrome.  

 

I don't know why organizr is trying to load http instead of https but this at least allows things to work the way I need!

Edited 23 hours ago by toyanucci

[toyanucci]

I've made further progress and found we no longer need to set that chrome flag to get this to work. We just need to add https://organizr.yourdomain.com (url you use to access organizr outside of your network) to /etc/nginx/nginx.conf and in organizr we need to add https://tower.yourdomain.com/Dashboard as the tab url for unRAID and the iframe will work!