Confluence page does not display in an iframe in Confluence Data Center
プラットフォームについて: Server および Data Center のみ。この記事は、Server および Data Center プラットフォームのアトラシアン製品にのみ適用されます。
Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Fisheye および Crucible は除く
本ページの内容には、Atlassian ソフトウェアのカスタマイズや拡張 (CSS ルール、HTML、JavaScript の追加/変更など) を行う手順が含まれています。アトラシアン サポートの提供 の通り、Atlassia 製品に加えられたカスタマイズはサポートされません。この資料は情報提供のみを目的として提供されています。内容はお客様自身の責任でご利用ください。
本件またはカスタマイズに関するご質問は、コミュニティの Atlassian Answers で質問してください。または、アトラシアン ソリューション パートナー にご相談いただくことをご検討ください。
Please note that Atlassian does not recommend making this change as it would make Confluence vulnerable to clickjacking. Remove this protection ONLY if you are willing to accept the security implications of doing so. You can use the example tools such as https://www.lookout.net/test/clickjack.html for the setting verification.
要約
When embedding a Confluence page in an <iframe /> on a different site the content doesn't display/show.
環境
Confluence 5.8.15 or higher
診断
When reviewing the loading of the page with your Browser's Developer Tools, the following message can be found:
Refused to display 'http://confluence.mycompany.com/display/SPC/My+Page' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".原因
Starting in Confluence 5.8.15, the headers below have been included to stop clickjacking:
Content-Security-Policy:frame-ancestors 'self'
X-Frame-Options:SAMEORIGINYou can read the original bug report here: CONF-29230 - Getting issue details... STATUS
Workaround 1)
Disable clickjacking protection from Confluence:
Confluence をシャットダウンします。
Please set the below JVM parameters (on all nodes if you are using multi-node DataCenter cluster) to disable security headers – See Configuring System Properties for more on setting System Properties.
To disable ' X-Frame-Options ', please set the below JVM parameter
-Dconfluence.clickjacking.protection.disable=trueTo disable ' Content-Security-Policy ', please set the below JVM parameter
-Dhttp.header.security.content.security.policy.disabled=true
- Restart Confluence (all nodes if you are using multi-node DataCenter cluster)
The Page will now appear in the iframe.
Workaround 2)
To allow the JSM Customer portal to display Confluence articles in an iFrame, you can follow the steps below:
- Confluence をシャットダウンします。
Set the below JVM parameters (on all nodes if you are using multi-node DataCenter cluster) to add the below argument to your setting for allowing only the Jira host to view Confluence content in an iFrame (please change <JIRA_BASE_URL> with yours before applying configuration.) – See Configuring System Properties for more on setting System Properties.
If Jira is not running as a service and the JVM parameters are configured in the setenv.sh or the setenv.bat file, please add the row below and update the <JIRA_BASE_URL> with context path.
CATALINA_OPTS="-Dhttp.header.security.content.security.policy.value=\"frame-ancestors 'self' <JIRA_BASE_URL>\" ${CATALINA_OPTS}"If the Jira application is configured as a Windows Service, please add the Java option below in a new line (without the double quotes):
-Dhttp.header.security.content.security.policy.value=frame-ancestors 'self' <JIRA_BASE_URL>
- Restart Confluence (all nodes if you are using multi-node DataCenter cluster)
Workaround 3)
Some security functionalities are enabled by default on Confluence 8.1.1 and later versions. Using the steps on this page will cause the application to fail. Make sure you're following the appropriate steps for your Confluence version.
Further information can be found: How to enable and configure HTTP Strict Transport Security (HSTS) response header on Confluence
If the Workaround 1) does not work then there is a possibility that in CONFLUENCE_HOME/conf/web.xml you have enabled HTTP Header Security Filter in Tomcat.
- Confluence をシャットダウンします。
- Open
CONFLUENCE_HOME/conf/web.xmland find antiClickJackingOption - Uncomment the parameter and change the value from DENY to SAMEORIGIN
- Confluence を再起動します。
Please see Apache Tomcat 8 Configuration Reference: HTTP Header Security Filter for more information on the parameters