No Basic Auth used, for iframes showing content from the same domain

[HolgerHees]

Currently I'm using iframes in my sidemap to show content from grafana, running on the same domain.

e.g. openhab.myserver.de is running openhab. Grafana is running on grafana.myserver.de or openhab.myserver.de/grafana/. Now I try to embedd grafana with a iframe in my openhab sitemap.

In the past, this was working for years. Since a while (I'm not sure how long exactly), I'm getting an unauthorized for the embedded iframe.

The rest works.

[maniac103]

It changed with #3988.
Problem here is simple: the app can't know whether both subdomains are under your control or not, thus it can't safely pass your credentials to a subdomain different from yours. We got a security report for that. Any reason for not using paths (myserver.de/grafana) instead or additionally?

[HolgerHees]

Main reason to not use mydomain.de/grafana. Grafana is part of a smartserver deployment, where each service is running under a subdomain. And this are ~30 in total. Make an exception for one service is using another service will change the whole deployment concept. In this moment, all other services has to use the openhab domain too, to reach grafana. And I can't provide grafana under 2 different subdomains, because is not supported by grafana.

For me the simplest solution to fix this security issues, just make it configurable. Just a button (send credential to all subdomains or not) or if you want to make it more flexible. The default behavior is like now, and if you enable the button, it is like before. Maybe also a whitelist for subdomains would work.

[HolgerHees]

If I try to use grafana with a subpath to embed charts, I get the following error.

But I can't to this config changes, because in this moment, grafana will only be usable via this "openhab" specific subpath and all other services which rely on a grafana domain will fail. It is also not unusual for services to be provided via a clean subdomain structure.