X-Frame blocks against i-Frames.

[de_millington]

Hello Canvas Developers,

Re: x-frame_blocks‌

I was wondering if anyone still uses iFrames these days and has found a suitable fix for x-frame blocks? An example is shown below where the iFrame was embedded wihin a page added to a module. This worked until the last few week or so. It's now broken in the latest versions of Firefox and Chrome.

Ok I realise these blocks are designed to combat 'clickjacking', but the standard solution offered by browsers seems to be extension tools. I'm not sure that this would work if the server is cloud based and not locally hosted.

I realise now why the Canvas solution for handling external web urls is to add an external url within a module. That opens up to a plainer than plain new tab with an even plainer button for the user to click and open the web page in a new window. Sure it works but it's so unattractive, so clunky.

Has anyone found a more attractive solution?

Thanks in advance

David

[themidiman]

This seems like it's the 3rd party site (unifrog) that's setting the x-frame response header so it's not something that is changeable by Canvas's codebase. Probably for good reasons like the ones you describe. If they have any desire to have their content be embedded within pages hosted by major LMS providers like Instructure, they should probably establish an LTI deep-link embed option. 

Anything else as a workaround could be possible (because in theory no system is ever 100% secure) so I'll be interested to see if any 'hacks' come up on this thread.

[de_millington]

OK I think I have found a legitimate hack that is workable. It's not as attractive as the i-Frame solution, but it's preferable to the beige offering of the Canvas external website link tool.

Use the Canvas redirect tool to create a link out to the external website. Then create a fancy button with any one of free online web or in-house tools, place it in the page you want to link out to the content, then copy the redirect-link to that button. This not only provides an attractive button , but it provides one click to the content rather than. 2-3 that the external link tool provides in a module.

[jen_anderson]

X-Frame blocks against i-Frames. I am getting the same "blocked by x-frame" message when trying to view a URL submissions in speedgrader. The URLs are links to a shared document or video in OneDrive. Why is this occurring with documents as well? This would not be an iframe right?

[de_millington]

Jennifer, if the document is web based and external, I would envisage the same problem. If the document is stored within the Canvas File area, that shouldn't be the case. I-frames however, appear to be at the juncture of extinction unfortunately, and Instructure, and other digital resource based vendors, do not seem to have an answer it would seem other than the one suggested by Jeffrey.  A third party vendor has confirmed what Jeffrey has already alluded to, that it is they who are placing the blocks, so that Instructure would not be able to do anything about it, even if they wanted!

You may have experienced a general slow down in response to queries put to the Canvas Community. Hopefully it's just a spasm or a seasonal blip, but I am finding response times tardy. Not sure if this has something to do with the current epidemiological regime imposed on societies or if it has more to do with the recent Instructure takeover. Hopefully things will pick up soon...

[jen_anderson]

The items I have had this issue with are links and iframed links from the Canvas community website as well as Microsoft products-- Stream videos, Word, PowerPoint, etc. Is this something that Microsoft would need to address on their end then?

[themidiman]

Yes...unless there's a workaround that perhaps the Office365 LTI might offer. Our institution blocks the feature of sharing content with everyone who has the link from user's OneDrive account so I can't test it.