Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

11.5 and iframes

Prior to 11.5 I was able to embed selected orion views on other webpages using iframes with a simple html as below. After upgrading to 11.5 I'm getting "This content cannot be displayed in a frame". Any knows how to get this going again.

</body>
</html>

Find more posts tagged with

Accepted answers

All comments

Detroiter

I am encountering this issue as well. I just upgraded to NPM 11.5, SAM 6.2 and EOC 1.6.2. Now my iframes are not working at all.

The same custom HTML can be loaded on an NPM Node Details page without issue. However, when using it on an EOC view, the frame is simply blank.

klinejw

I got this from support at it works for us:

Hi Joe,

The devs needed time to detail why the change was made - here's what they say:

The reason why it's not possible to use it Orions web page for loading into the framework via iframe is not a bug; instead it's a new security protection against Cross Site Request Forgery (CSRF) and against click jacking attacks.

This means that by default we are protecting our users against CSRF in the latest release. There is only one way how we could do that:
- to setup policy domain on SAMEDOMAIN policy and to setup X-Frame options on samedomain while adding the following parameters into web config:

X-Same-Domain: 1
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

What does it mean for you?

If you want to use to load Orion web page inside your web site, go to the
web folder ( by default named "C:\inetpub\SolarWinds", open the web.cfg file for editing, and delete those keys from web config:

<add name="X-Frame-Options" value="SAMEORIGIN" />

and save the changes and then press Ctrl+F5.

Then the Orion web page could be loaded thorough iframe BUT you will not be protected against Cross Site Request Forgery and against click jacking attacks. I would like to point that CSRF is one of the TOP 10 vulnerabilities which could be used for attack.

Detroiter

I got the same email I have my web.config file ready for editing, but what to change and where is a bit vague. Hopefully my support guy gets back to me soon.

sshgraham

Great..thanks guys. Everything is back to normal after removing line below from web.config.

chris.engstrom

I removed the following with out results:

danielgilbey

Love these forums! Came here for exactly this & it's all working now as it was before...

Must have missed this in the release notes...

Line 522 in the web.config file (mine at least?) for anyone else looking to do the same

TinyElvis

Wow... there went my Friday. It wasn't until 1/2 way through a Dominion Morning Glory Espresso Stout that I noticed in the Wireshark trace this little guy:

X-Frame-Options: SAMEORIGIN\r\n

One quick search to figure out if that was part of an upgrade feature here on thwack got me here.

I do appreciate the effort for added security... but this was critical to a lot of different pages we have.

I commented mine out, so I know where it is and is easily uncommented if necessary:

Thanks for raising this everyone. I had a lot of cursing at my machine tonight. Good way to end late on a Friday!

mxr662

Does the config wizard replace the web.config file with original? Seems like one of our solarwind instances reverted back.

mxr662

Appears the config wizard reverts back to original file.

djiboutidave

So I did this and now am getting a runtime error when trying to access the web console. The file web.config looks like it was changed into a .txt (from the icon) but still says config in the type column. Any suggestions? I now can't access solarwinds from the web at all.

msfadmin

So I just upgraded to 12.0 on NPM and 6.3 on SAM, and it overwrote the web.config file. Finding this thread was a great find and I didn't delete the line, I only modified it.

https://support.solarwinds.com/Success_Center/Network_Performance_Monitor_(NPM)/Unable_to_load_iFrames_for_remote_users

Resolution

Go to the Orion Server.
Make a copy of C:\inetpub\SolarWinds\web.config.
Open the original web.config file for editing (May require administrator).
Make the following change:
1. On the section that contains <add name="X-Frame-Options" value="SAMEORIGIN" />.
2. Change this to <!-- add name="X-Frame-Options" value="SAMEORIGIN" / -->.

dodo123

Was just looking at setting a page on an external system and ended up here, if this is such a security hole is there not a way that we could have a whitelist? that way we are not breaking this security hole and it wont get wiped out by the config wizard. A bit like when you change the website table so annoying to have to go back and change it.

msfadmin

So I just upgraded again to NPM 12.1 and SAM 6.4 cause I need to install NCM 7.6, and by doing so it reset my web.config file again. So I went back in to try to modify it by adding the !-- to that line. However this time, it's not rendering my frames on my internal Intranet site. Has anyone that's upgraded again recently seen this?

Detroiter

I just did an SRM hotfix for 6.4 and am on NPM 12.1. I was able to remove the offending section from my webconfig without issue. My iFrame report displays properly.

msfadmin

it's rendering now. clerical issue, didn't add the "--" at the end of the line. It's noted now on my cheat sheet.

sonis718

thanks for posting, i was just getting ready to call support on this.

chack10

This is just what I needed . Thanks sshgraham for starting this post 3 years ago!