0

I have a WordPress site hosted at https://myblog.com. I also have a Chrome extension that injects a content script into https://anothersite.com to modify its UI.

My goal is to embed my WordPress posts within an iframe on https://anothersite.com.

I have successfully achieved this, but when users attempt to log in to WordPress, they encounter the following error:

wp-login.php:1 
Blocked a frame with origin "https://myblog.com" from accessing a cross-origin frame.
    at tryShowingMateBar (eval at success (chrome-extension://kacbklkbjmnjkhnellgciecdogkkldoj/src/kernel/kernel.js:233:37), <anonymous>:5428:57)
    at eval (eval at success (c...

I DONT WANT to access frame's content from my extension. I just wnat to display my wordpress site correctly, and user can do login or logout properly on iframe.
(I know there is a safe solution for communicating between iframe and parent by using window.postMessage)

To address this issue, I added the following headers to my WordPress site's wp-config.php file:

header('Content-Security-Policy: frame-ancestors https://anothersite.com https://myblog.com chrome-extension://kacbklkbjmnjkhnellgciecasdkldoj');
header('Content-Security-Policy: frame-src https://anothersite.com https://myblog.com chrome-extension://kacbklkbjmnjkhnellgciecasdkldoj');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: *');

However, this solution didn't work. I'm still encountering the same cross-origin access issue. Can anyone help me resolve this problem?

Thank you!

hich9n
  • 1,578
  • 2
  • 15
  • 32
  • Judging by the error there's a mistake in your tryShowingMateBar. – wOxxOm Jun 03 '23 at 14:13
  • It is not my code. I don't write any js. Just wnat to raw wordpress in extension. @wOxxOm – hich9n Jun 03 '23 at 14:28
  • Regardless of who wrote the code, the problem is there. – wOxxOm Jun 03 '23 at 15:05
  • yep, but it is "chrome code"! I can't change it. anyway, maybe I cant show iframe in chrome extension, or maybe it is a bug in chrome. – hich9n Jun 05 '23 at 08:35
  • Depending on the code in that extension, there may be a way to prevent it from seeing the iframe e.g. if you put it inside shadow DOM. – wOxxOm Jun 05 '23 at 12:53

0 Answers0