I'm working on a canvas app. I need to prevent it from being iframed from unauthorized sources. The problem is I don't know what to set as the CSP frame-ancestors in the headers for my canvas app. It doesn't seem to be the instance url the user is on.

I tried a number of things. There were fields in the signed request I thought might be the ancestor for my canvas app. I tried signedRequest.client.targetOrigin and signedRequest.environment.locationUrl to no avail.

I noticed that canvas is putting the actual iframe for my app inside an outer iframe. I imagine that could change what address is considered the ancestor of my app's iframe.


I checked window.location.ancestorOrigins (evaluated within my app) and tried setting the report-uri directives in the CSP header to see if the csp-report had any useful information. I tried hard coding the promising urls I found as the frame-ancestors. None of them worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.