Hello, I have another question, I need to add pact...
# pact-broker
c
Hello, I have another question, I need to add pactbroker within the backstage however when I tried to use it via iframe I got the following error:`Refused to frame 'http://localhost:9292/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".` is it possible to adjust pact to allow iframe? My code:
Copy code
export const ExampleFetchComponent = () => {
  const classes = useStyles();

  const { value, loading, error } = useAsync(async () => {
    // Simulação de uma chamada assíncrona para obter a URL do iframe
    // Você pode substituir isso por sua lógica real
    const url = '<http://localhost:9292/>';
    return url;
  }, []);

  if (loading) {
    return <Progress />;
  } else if (error) {
    return <ResponseErrorPanel error={error} />;
  }

  // Renderizar o iframe
  return (
    <div className={classes.iframeContainer}>
      <iframe
        className={classes.iframe}
        src="<http://localhost:9292/>"
        title="Iframe Example"
        allow="fullscreen"
      />
    </div>
  );
};
m
It looks like this might be the code you need to modify if using nginx / proxy isn’t an option: https://github.com/pact-foundation/pact_broker/blob/ff72d03c567b76939db8d7450fad2a1d20879b5b/lib/pact_broker/configuration.rb#L71
c
@Matt (pactflow.io / pact-js / pact-go) About this I use a load balancer, in this case I would have to capture the request and change the header right? The iframe will be in the application https://backstage.mycorp.intranet/ so it should look like this, right?
X-Frame-Options: ALLOW-FROM <https://backstage.mycorp.intranet/>
@Matt (pactflow.io / pact-js / pact-go) I was able to test it by injecting the
Content-Security-Policy: frame-ancestors
* header and it worked inside the iframe, thank you very much
m
Perfect! Yes
x-frame-options
is deprecated, and the CSP headers is a better way to go. Glad you could sort it out!