How to solve "Content Security Policy" issue with store.

[fantashy1809]

Hi all,

I had a problem when I use <iframe> in my apps. This is my problem:

Refused to display, in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'". 

I build an app with localhost, I do not know how to solve this problem.

Thanks

[Alex]

Can you share more details about your implementation? Are you placing an iframe inside your already embedded app, or on the storefront for example? With a bit more info I can replicate and look into what might be the issue for you.

Cheers.

[fantashy1809]

Hi Alex, 

I placed iframe inside my embedded app to load storefront page. I am building a third-party app to tracking behavior users, and imitate user behavior through position x, y to create a video which like record user. However, I read the policy change when load storefront page. So I am trying to find another alternative solution.

Thanks

[LD_]

This issue is happens for us then store domain is different from admin domain. 

How to reproduce: Create draft order -> Send Invoice -> Review invoice -> [click on link with registered domain in Shopify inside].

To Shopify dev: If you apply this rule you should specify the registered domain at least or give us ability to set headers.

[Mikecampbell]

First, ensure that the URL's you supplied in the App Whitelist and Auth callbacks are HTTPS.

Next, clear out your local storage (if the URL has changed since you last ran the app, and if anything goes wrong in general, this is a blunt tool to approach this).  It forces you to log out, clearing your cookies and such, and starts from scratch.

[1080]

@Alex   I have same issue i am not render any iframe inside the embedded  app but still getting Error.  this error not replicated in unpublished app. when i move to production app. only one page this issue happens other page i can see it was load and working.

[Shiv7040]

I am also having the same issue, the iframe doesn't load on my contact us page and showing the the error "because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'" please help

[jonji]

Have you fixed this issue?