[prev in list] [next in list] [prev in thread] [next in thread]
List: shibboleth-users
Subject: framebusting/clickjacking stuff
From: Jerry Shipman <jes59 () cornell ! edu>
Date: 2021-11-15 21:24:30
Message-ID: 14CDF923-2C9B-4015-8DDE-91B86235B842 () cornell ! edu
[Download RAW message or body]
[Attachment #2 (text/plain)]
Hello,
I am pretty sure I know the answer to this already, but I have to ask...
Some of our websites have "embedded content" where they put a tableau chart or \
something like that into an iframe on their website. When they do something like \
this, when the website-inside-the-iframe (e.g. tableau) requires a SAML login, it \
doesn't work because of the framebusting/anti-clickjacking stuff in the SSO login \
page (shib IdP).
I'm trying to figure out a good solution for them.
It seems like with Tableau, there is a setting we can change to alter its behavior, \
so it will pop up in a new window or something instead of trying to work in the \
frame. So we are going to look at that. For other websites, it might be harder to \
fix.
Does anyone out there have a favorite workaround for this issue?
Thank you for your help,
Jerry
[Attachment #3 (text/html)]
<html xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal">I am pretty sure I know the answer to this already, but I have \
to ask...<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Some of our websites have "embedded content" where \
they put a tableau chart or something like that into an iframe on their website. When \
they do something like this, when the website-inside-the-iframe (e.g. tableau) \
requires a SAML login, it doesn't work because of the framebusting/anti-clickjacking \
stuff in the SSO login page (shib IdP). <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I'm trying to figure out a good solution for \
them.<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It seems like with Tableau, there is a setting we can change to \
alter its behavior, so it will pop up in a new window or something instead of trying \
to work in the frame. So we are going to look at that. For other websites, it might \
be harder to fix.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Does anyone out there have a favorite workaround for this \
issue?<o:p></o:p></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for your help,<o:p></o:p></p>
<p class="MsoNormal">Jerry<o:p></o:p></p>
</div>
</body>
</html>
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net
--===============5213828531740036158==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic