Markdown preview doesn't work #1409

Activity

1. nhooyr

   added

   bugSomething isn't workingSomething isn't working

   on Mar 11, 2020
2. nhooyr commented on Mar 11, 2020

   

   nhooyr

   on Mar 11, 2020

   ContributorAuthor

   More actions

   Seems to be an iframe issue #296 (comment)

   Maybe related to #1401
3. ViRb3 commented on Mar 12, 2020

   

   ViRb3

   on Mar 12, 2020

   Last edited by ViRb3

   More actions

   Apologies, the problem was in an inherited nginx config:

   # XSS
   add_header X-Frame-Options DENY;
   add_header X-Content-Type-Options nosniff;
   add_header X-XSS-Protection "1; mode=block";

   Everything works after I cleared those headers. Feel free to close this issue.
4. nhooyr

   closed this as completedon Mar 12, 2020
5. nhooyr commented on Mar 12, 2020

   

   nhooyr

   on Mar 12, 2020

   ContributorAuthor

   More actions

   Glad you figured it out.

   ❤️React with ❤️1Reacted by Kyle Carberry
6. jgsun commented on Sep 12, 2021

   

   jgsun

   on Sep 12, 2021

   More actions

   Apologies, the problem was in an inherited nginx config:

   # XSS
   add_header X-Frame-Options DENY;
   add_header X-Content-Type-Options nosniff;
   add_header X-XSS-Protection "1; mode=block";

   Everything works after I cleared those headers. Feel free to close this issue.

   I am wondering how to or where to clear those headers? Thanks you very mucy!

   👍React with 👍3Reacted by Benjamin Cabalona Jr., Li Dongsheng and Aaron Cody
7. miramar-labs commented on Apr 8, 2022

   

   miramar-labs

   on Apr 8, 2022

   More actions

   It's still happening in the latest builds - any chance you could elaborate on the 'fix' mentioned above ?
8. ViRb3 commented on Apr 8, 2022

   

   ViRb3

   on Apr 8, 2022

   More actions

   I have a global nginx config called tls.conf which sets the following "security" headers:

   # XSS
   add_header X-Frame-Options DENY;
   add_header X-Content-Type-Options nosniff;
   add_header X-XSS-Protection "1; mode=block";

   These cause requests to be blocked by the browser while using code-server, resulting in the issue here. To fix it, simply don't set or clear the three headers mentioned above. For example:

   server {
       server_name foo.bar;
   
       location / {
           # override from tls.conf
           # required for Markdown preview
           add_header X-Frame-Options "";
           add_header X-Content-Type-Options "";
           add_header X-XSS-Protection "";
   
           proxy_pass http://code-server:8080;
       }
   
       listen 443 ssl http2;
       include presets/tls.conf;
   }

   Hope this makes sense.

   ❤️React with ❤️1Reacted by Joe Previte