807088 - Allow x-frame of ToS and PP for Persona dialog

Status: RESOLVED FIXED

(Marketplace Graveyard :: Consumer Pages, defect, P2)

Description

[Sean McArthur [:seanmonstar]]

We need to show the ToS and PP in an iframe in the dialog. While testing, we're using *.personatest.org, and when live, it will be *.persona.org. * because the subdomains aren't certain yet.

Comment 1

[Kumar McMillan [:kumar]]

FYI, the marketplace URLs that need the header adjustments can be seen here https://github.com/mozilla/zamboni/blob/master/media/js/mkt/login.js#L5

Comment 2

[Wil Clouser [:clouserw]]

Should just be a matter of putting this in the view:

> response = jingo.render(request, 'sometemplate.html', {})
> response['x-frame-options'] = 'allow'
> return response

There might be a decorator for it too.

Comment 3

[Kumar McMillan [:kumar]]

(In reply to Wil Clouser [:clouserw] from comment #2)
> > response = jingo.render(request, 'sometemplate.html', {})
> > response['x-frame-options'] = 'allow'

Be careful with this. We should only allow the persona domain(s), not all domains. The header to use is allow-from http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-00#section-2.4.1

However, it looks like we may not be able to specify multiple domains: http://stackoverflow.com/questions/10205192/x-frame-options-allow-from-multiple-domains

We could add a setting to flip it between persona.org and personatest.org because I don't think we'd need both at the same time. The test one is useful on mkt dev in the rare case that we need to test out an unreleased persona feature.

Comment 4

[Sean McArthur [:seanmonstar]]

To make it more fun, personatest.org is only used for breakout features, like this b2g dialog. Once it's merged back in, typical dev domain is dev.anosrep.org.

Comment 5

[Allen Short [:ashort]]

https://github.com/mozilla/zamboni/commit/d887658ebc8bc490b06e7fa706ce984bc38d9110

Comment 6

[Sean McArthur [:seanmonstar]]

We're currently testing the B2G dialog and marketplace from notoriousb2g.personatest.org, and it sounds like the eventual domain will be fxos.login.persona.org.

Comment 7

[Kumar McMillan [:kumar]]

Per comment #6 we need to allow it for multiple domains. It's just PP and TOS so we might as well allow-all.

Comment 9

[John Morrison [:jrgm]]

For completeness, you should get a Referer: header which would give you a domain that you could dynamically allow (if it's on a whitelist) with the x-frame-options: header.

Comment 10

[Christopher Van Wiemeersch [:cvan]]

https://github.com/mozilla/zamboni/commit/6253750