TYPO3 Core

I am not quite sure how to answer you.

What I found out is that although I make the following settings in htaccess
Header set Content-Security-Policy "frame-src 'self' https://mydomain.tld; frame-ancestors 'self' https://mydomain.tld;"

the directive "frame-ancestors" is set to "none" when the page is loaded in the view iFrame.

So it seems as if somewhere in TYPO3 the directive "frame-ancestors" seems to get overridden somehow. But I have no idea where to look.

TYPO3 ships its own backend CSP headers. Can you please remove any custom CSP settings in your htacces/webserver config and see if that maybe causes the issue?

I added my own headers as a result of the problems I had. So removing them will not remedy the situation.

Somewehre in TYPO3 the directive "frame-ancestors" must set to "none" - and as it seems, setting it in .htaccess has no influence.

You can (must) use the CSP API of TYPO3 so that you can modify the backends CSP rules properly. Adding them via htaccess is not a viable option.

Please see https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/ContentSecurityPolicy/Index.html on how to achieve this.

If you can be more specific about why and for what you needed the custom CSP htaccess header maybe can help to tell how to do it with the API.

Thanks for the hint.

I deactivated my .htaccess settings and tried to use the approach with EXT:my_extension/Configuration/ContentSecurityPolicies.php in my site package ("Policies for frontend and backend can be applied automatically by providing a Configuration/ContentSecurityPolicies.php file").
Unfortunately it does not work.

Although I set the directive

        new Mutation(
            MutationMode::Set,
            Directive::FrameAncestors,
            SourceKeyword::self,
        )

it has no effect. frame-ancestors is still set to 'none'.

When I take a look into "TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive" I see that "FrameAncestors" does not seem to be part of the list of directives which can be mutated.
Is there a specific reason for this? And what can I do about it?

Michael Perlbach wrote in #note-7:

When I take a look into "TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive" I see that "FrameAncestors" does not seem to be part of the list of directives which can be mutated.
Is there a specific reason for this? And what can I do about it?

You can see that there are multiple "ContentSecurityPolicies.php" files from TYPO3 system extensions, like "cms-frontend" and "cms-backend".

typo3/sysext/backend/Configuration/ContentSecurityPolicies.php sets this:

        new Mutation(MutationMode::Extend, Directive::FrameSrc, SourceKeyword::self),

Your code above isn't the full code you use, could you please show that?

Also, you may want to check your "System > Configuration > Content Security Policy Mutations" list. This shows you which directives are inherited and configured exactly.

To have a normal TYPO3 preview working, the rule:

frame-src 'self' *.youtube-nocookie.com *.youtube.com *.vimeo.com;

ensures that my iframe backend preview properly works; a 'frame ancestors' setting might not even be needed at all?!

Unfortunately setting "frame-src" to "self" or my tld does not help. This is how I set up my configuration (works with neither "set" nor "extend"):

<?php

declare(strict_types=1);

use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Directive;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Mutation;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationCollection;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\MutationMode;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\Scope;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\SourceKeyword;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\SourceScheme;
use TYPO3\CMS\Core\Security\ContentSecurityPolicy\UriValue;
use TYPO3\CMS\Core\Type\Map;

return Map::fromEntries([
    // Provide declarations for the backend
    Scope::backend(),
    new MutationCollection(
        // Results in `default-src 'self'`
        new Mutation(
            MutationMode::Extend,
            Directive::DefaultSrc,
            SourceKeyword::self,
        ),

        new Mutation(
            MutationMode::Extend,
            Directive::FrameSrc,
            SourceKeyword::self,
        ),

        new Mutation(
            MutationMode::Extend,
            Directive::FrameAncestors,
            SourceKeyword::self,
        )
    ),
]);

I tested it with several browsers. The error message sent back from the browsers was always that "frame-ancestors" is set to "none" which forbids browsers to load a page in the iFrame. "frame-ancestors" seems to be set to "none" by TYPO3 and there seems to be no way to change it as "frame-ancestors" is not part of the list of directives that can be changed. I just wonder what the rationale behind leaving out "frame-ancestors" from the list of changable directives is. Some security considerations?

I just checked my csp headers and they are correct - but when I load the page the Javascript console tells me that frame-ancestors is set to "none" although it is set to "self" in the csp-header. So the problem seems not to be related to TYPO3. Case can be closed - and thanks for the hints.

Just a last add from my site - I found the cause for my problems.

In the site package I was using the typoscript "ext:<extname>/Configuration/Sets/<setname>/Typoscript/Config/HTTPHeaders.typoscript" contained the entry
additionalHeaders.60.header = Content-Security-Policy: frame-ancestors 'none'

Commenting this solved the problem.

Great, thanks for letting me know, happy to know the real cause of it :-)