Using iframes in Custom HTML widgets

Question

I'm trying to get the Custom HTML to work with another instance of Orion on a different server. We want to have a view with alerts from both Orion instances. The widget just shows "connection refused". The code is this: In an earlier Thwack article from 2021, https://thwack.solarwinds.com/products/network-performance-monitor-npm/f/forum/89816/custom-html-widget-not-working%2C it was recommended to change this database setting: Update [DATABASENAME].[dbo].[WebSettings] SET [SettingValue] = 'False' Where [SettingName] = 'HTMLResourceSanitizationEnabled' However, that setting is no longer in dbo.WebSettings. Does that setting still exist somewhere? Edit: I have found the 'HTMLResourceSanitizationEnabled' setting in the Advanced Configuration, but it was already set to unchecked (presumably that means 'false'). Or is there another way, Custom HTML or otherwise, to pull up a remote web page inside of an Orion dashboard. We have 2 widgets that work to external sites, but for some reason it won't work on the other instance of Orion. Same code as above. Note: This is an alternate to using Enterprise Operations Console, which has issues with logins that we are not happy with.

hebron1212 · Answer

I was able to get the iframe to work by setting the remote web server X-Frame-Options to ALLOW-FROM and the host with the widget. Now the remote site is telling me to enable cookies after entering my id/password. The website works fine outside of the widget. The same widget worked fine pointing to our dev instance.

hebron1212 · Answer

Thanks so much for your detailed response. I do have some questions.

For #1, I do not see X-Frame-Options or XFrameOptions or frame-ancestors under the Orion Advanced Configuration. Mine is at a different URL: /Orion/Admin/AdvancedConfiguration/Global.aspx. Or are you talking about another Advanced Configuration? Maybe IIS? I've tried the URL you listed and just got a "does not exist" error.

#2 and #3 are not an issue.

For #4, I can pull up the other instance as a Menu Bar, but what I need is the alerts page for both instances on the same page. (I had originally planned on doing this with 2 Custom HTML widgets, one on the main instance and one on the remote.) I get the same "refused to connect" error with the External Website resource.

Ansab138 · Answer

The "Connection Refused" error (and the fact that your current HTML Sanitization setting is already false) suggests that the issue isn't within the Custom HTML widget itself, but rather a security policy on the target Orion server (the one you are trying to pull into the iframe). Modern browsers block iframes by default if the target website sends a specific security header. Here is how to fix this: 1. The Primary Culprit: X-Frame-Options SolarWinds Orion/HCO servers are configured by default to prevent "Clickjacking." This means they send a header called X-Frame-Options: SAMEORIGIN. This tells the browser: "Only allow this website to be framed by a page on the same domain." Since your two Orion instances are on different servers/URLs, the browser sees the mismatch and blocks the connection. The Fix:You need to tell the target Orion server to allow being framed. * On the target Orion server, go to the Advanced Configuration page (/Orion/ControlPanel/AdvancedConfiguration.aspx). * Search for X-Frame-Options or XFrameOptions. * If it is set to SAMEORIGIN, try changing it to ALLOW-FROM https://your-source-orion-url.com (or simply clear the value to test, though this is less secure). * Note: Many modern browsers now ignore ALLOW-FROM. If that doesn't work, you may need to look at the Content-Security-Policy (CSP) settings in the same Advanced Configuration menu and add your source Orion URL to the frame-ancestors directive. 2. Check the WebConsole SSL/TLS Mismatch If your source Orion is using https:// and your target is using http://, the browser will block it as "Mixed Content." * Ensure both are using https. * Ensure the SSL certificate on the target server is trusted by the user's browser. If it’s a self-signed cert and the user hasn’t manually "accepted" it for that specific URL in a separate tab, the iframe will show a connection error. 3. The "Legacy" Database Setting You mentioned HTMLResourceSanitizationEnabled moved. In newer versions of HCO (2022.x, 2023.x, and 2024.x), many settings moved from WebSettings to the Settings table or are only accessible via the Global Selection in Advanced Configuration. * If you've already unchecked it in Advanced Configuration, the database has already been updated. The database query is no longer the recommended way to change this. 4. A Better Alternative: "Custom External Website" Instead of using a Custom HTML widget, try this: * Go to Settings > All Settings. * Under the "Node & Group Management" or "Views" section, look for Manage Views. * Instead of a widget, try adding a Menu Bar item that points to the other Orion instance. * Alternatively, use the "External Website" resource specifically. It is designed to handle some of the framing logic better than a raw