Iframe Embedding

The console shows its sibling apps (Mail, SMS, SEO…) in iframes so they form a single product. Two things make this work: a platform-wide Content-Security-Policy that allows framing, and the session hand-off that signs the user in to the framed app.

The shared policy

The platform sends the same Content-Security-Policy for every app. For framing, two directives matter:

Directive Includes Effect
frame-src 'self', https://*.inklura.fr, https://auth.1clic.pro, plus third-party services (payments, bot checks, reCAPTCHA, video) and a few other sites The console can show its sibling apps and the identity provider
frame-ancestors 'self', https://*.inklura.fr Each app can be shown inside a *.inklura.fr page

frame-src defines what a page can show, frame-ancestors defines who can show a given app. Under the shared policy, a third-party site cannot frame an Inklura app.

Note

This policy is set by the platform, not per app. An app can send its own policy on some pages (for example a page meant to be embedded on a third-party site): it then replaces the shared policy for those pages.

Tip

As far as the policy is concerned, every *.inklura.fr subdomain is already covered: an app on an Inklura subdomain can be framed by the console with no extra setting.

Showing a sibling app

Do not point the iframe straight at the app's page. Point it at the console's launch route, so the framed app opens its session before it renders:

<iframe src="/api/manage/designer-sso?app=mail&next=/manage&embed=1"></iframe>

The route issues a short-lived token and redirects to the app, which opens its session and then shows the next page. The embed=1 parameter is passed on to the app to tell it that it is shown inside the console. The route requires a console session: without one, the iframe shows the console's sign-in page, and an unknown app value goes back to /manage. See Single Sign-On for the full parameter list, the token's lifetime and its guarantees.

Same site or new tab

Not every app is shown in an iframe. When the console launches an app:

  • apps served on the console's own domain (*.inklura.fr), such as Mail, SMS, SEO, support and point of sale, are shown in the iframe, which the policy above allows;
  • apps that live on another domain, and a few others, open in a new tab.

The reason is the session cookie: the app opens its session with a SameSite=Lax cookie, which the browser only sends to an iframe on the same site as the page that shows it. An app on another domain can only be shown in the console if it sets a partitioned session cookie (CHIPS) when framed, and if the console page that shows it allows its origin in frame-src.

See also