Code-server: Disabled in this document by feature policy inside iframe

[rohinrohin]

Hi,
A couple of our users are facing this issue where we have code-server embedded inside and iframe. It was working fine for a month or so now.

But recently this issue has started repeating. Any idea on how we can resolve this?

Any help is appreciated.
Thanks!

[rohinrohinsa]

I can confirm that the latest Chro.e update v81(April release) has caused the copy paste feature to break.

[kylecarbs]

Will look into this. Thanks!

[kylecarbs]

Is this only inside an iframe?

[rohinrohinsa]

Yeah only inside an IFrame.

On Tue, 14 Apr 2020 at 8:12 PM, Kyle Carberry [e-mail]
wrote:

Is this only inside an iframe?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cdr/code-server/issues/1509#issuecomment-613483707,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/APCIDPJRPS6T7KGTWRDNBMLRMRY5BANCNFSM4MFQOVOA
.

[code-asher]

Maybe it's https://github.com/cdr/code-server/issues/1401? If the site hosting the iframe has a different origin then the iframe itself.

[code-asher]

Er, nevermind, that would only be for logging in and this issue doesn't say anything about logging in.

[rohinrohin]

Hey - any updates on this issue? This is an issue in production for us and users are not able to copy/paste within an iframe.

[code-asher]

I haven't had a chance to try Chrome 81 or later yet but I wonder if something like this works:

<iframe src="https://example.com..." allow="document.write"></iframe>

https://developers.google.com/web/updates/2018/06/feature-policy#iframe

[code-asher]

Although that would only affect pasting. If copying also isn't working then I'm not sure. document.write seems to be the only relevant feature name. Here are the names in the source.

[scarolan]

This is also affecting our users. We run code-server inside a container on the Instruqt platform, which apparently uses iframes for each tab in the learning environment.

[kylecarbs]

We'll be fixing this ASAP.

[kylecarbs]

Seems like there's not much we can do :(

https://github.com/w3c/webappsec-feature-policy/issues/322

[dway123]

Sorry, I suspect this was caused by https://crbug.com/1074489, which we're working on fixing right now.

[scarolan]

Hello friends. @kylecarbs you indicated that this is an upstream issue. @dway123 any progress on a fix?

[OliverwengFiltered]

@dway123 any updates on the fix?
we are experiencing the same.

[dway123]

Any updates will be available at https://crbug.com/1074489.

[dway123]

A fix is now merged to Chrome M85+. Feature policies clipboard-read and clipboard-write may be used to control the Clipboard API in iframes. For more information, please see https://crbug.com/1074489.

[rberlind]

We seem to be seeing this problem starting today again in Chrome 84 accessing Instruqt.

[rberlind]

I upgraded Chromse to 85 today and still see same issue.

[OliverwengFiltered]

I upgraded Chromse to 85 today and still see same issue.

I didn't try but I think you need to add feature-policy in iframe with value "clipboard-read" , chrome v85 gives the ability for you to add the clipboard-read as the feature policy, but it doesn't allow it automatically.
Let me know how it goes.

[rberlind]

Thanks @OliverwengFiltered. But the website I'm using is outside my control. Or I should say, I am embedding something into a learning platform. They control the parent windows while I am inserting VSCode Editor into a tab.

[OliverwengFiltered]

Thanks @OliverwengFiltered. But the website I'm using is outside my control. Or I should say, I am embedding something into a learning platform. They control the parent windows while I am inserting VSCode Editor into a tab.

Hi @rberlind , I just tested, it works in chrome v85 if you add an additional property into iframe tag like below

<iframe allow="clipboard-read;">...</iframe>

however you do need ability to change/access to the iframe tag code, which in your case, maybe a block here.

[rberlind]

Thanks for checking, @OliverwengFiltered

[nhooyr]

Glad this is now fixed. Cheers! 🍻