Disabled in this document by feature policy inside iframe

[rohinrohin]

Hi,
A couple of our users are facing this issue where we have code-server embedded inside and iframe. It was working fine for a month or so now.

But recently this issue has started repeating. Any idea on how we can resolve this?

Any help is appreciated.
Thanks!

[rohinrohinsa]

I can confirm that the latest Chro.e update v81(April release) has caused the copy paste feature to break.

[kylecarbs]

Will look into this. Thanks!

[kylecarbs]

Is this only inside an iframe?

[rohinrohinsa]

Yeah only inside an IFrame.

…

On Tue, 14 Apr 2020 at 8:12 PM, Kyle Carberry ***@***.***> wrote: Is this only inside an iframe? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1509 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APCIDPJRPS6T7KGTWRDNBMLRMRY5BANCNFSM4MFQOVOA> .

[code-asher]

Maybe it's #1401? If the site hosting the iframe has a different origin then the iframe itself.

[code-asher]

Er, nevermind, that would only be for logging in and this issue doesn't say anything about logging in.

[rohinrohin]

Hey - any updates on this issue? This is an issue in production for us and users are not able to copy/paste within an iframe.

[code-asher]

I haven't had a chance to try Chrome 81 or later yet but I wonder if something like this works:

<iframe src="https://example.com..." allow="document.write"></iframe>

https://developers.google.com/web/updates/2018/06/feature-policy#iframe

[code-asher]

Although that would only affect pasting. If copying also isn't working then I'm not sure. document.write seems to be the only relevant feature name. Here are the names in the source.

[scarolan]

This is also affecting our users. We run code-server inside a container on the Instruqt platform, which apparently uses iframes for each tab in the learning environment.

[kylecarbs]

We'll be fixing this ASAP.

[kylecarbs]

Seems like there's not much we can do :(

w3c/webappsec-permissions-policy#322

[dway123]

Sorry, I suspect this was caused by https://crbug.com/1074489, which we're working on fixing right now.