BrowserPolicy.content.allowFrameOrigin Ignored

[caseygibson]

I’m trying to load the Wirdcard payment URL into an iFrame and it’s being blocked by Refused to display ‘https://wpp-test.wirecard.com/seamless’ in a frame because an ancestor violates the following Content Security Policy directive: “frame-ancestors https://example.com”.

I have to pass in a frame-ancestor URL when creating the payment on the server which is our main URL, but since the Meteor App on Android and iOS is using “localhost”, it’s therefore creating the clash.

I’ve tried this on the server:

Meteor.startup(function () {
     BrowserPolicy.content.allowFrameOrigin("https://wpp-test.wirecard.com/");
});

It’s completely ignored by the client. Is there anything else that I need to do to tell the iFrame to ignore the CSP?

Thanks!

[rjdavid]

For cordova, please check this discussion.

Correct way of setting Content Security Policy for a meteor cordova app

Actually, it doesn’t change so often: https://github.com/meteor/meteor/commits/devel/packages/boilerplate-generator/template-web.cordova.js But sure, it would be good to be notified on changes. There are web services available to watch for changes to web pages, maybe target the link with the commit-history above? Not ideal but there seems to be no alternative.

[caseygibson]

This hasn’t helped as it looks like all it does is define CSP rules on the index page for Cordova. I’m wanting to force the Cordova browser to ignore the frame-ancestors rules.