Issue
- After including an iframe link in a third-party application for our clustered Liferay environment (and already setting the appropriate X-Frame-Options), users are experiencing repeated authentication prompts even though they are already logged into Liferay.
- In the browser console, we can see errors relating to invalid X-Frame-Options header and restricted access due to cross-origin framing:
Invalid 'X-Frame-Options' header encountered when loading 'https://webserver-url.com/': 'ALLOW-FROM http://localhost:8085/' is not a recognized directive. The header will be ignored. ... Uncaught DOMException: Failed to read a named property 'href' from 'Location': Blocked a frame with origin "https://webserver-url.com" from accessing a cross-origin frame. ... Failed to load resource: the server responded with a status of 403
Environment
- Liferay DXP (any version)
Resolution
- This issue is caused by a mismatch in SameSite values being applied between the application server's cookies and the web server's cookies. To resolve this:
- Evaluate the SameSite values for your configured domains
- Align those values with their associated cookies
- If you prefer to use DXP inside Iframes and disable SameSite functionality, ensure that CORS and CSRF protection are configured correctly to mitigate cross-site requests.
Additional Information
- For example, if NGINX is the web server vendor in use, you can add the following to the web server's configuration file within the location tag:
proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=none";
When configuring NGINX cookies, avoid appending these values to the path parameter and look into leveraging proxy_cookie_flags instead.
- For more information, please see: