CF_Authorization cookie not passed to iframe

[alex.rogozhnikov]

We’re using ZTN (and it works).
I want to embed into iframe the content served on one of tunnels.

I have a dummy hello-tunnel in cloudflared.

The page opens normally and here are the response headers:
Status: 200

Response Headers (likely not important)

1. alt-svc: h3=“:443”; ma=86400, h3-29=“:443”; ma=86400
2. cf-cache-status: DYNAMIC
3. cf-ray: …
4. cf-team: …
5. content-encoding: br
6. content-type: text/html; charset=utf-8
7. date: Sun, 18 Dec 2022 19:12:56 GMT
8. nel: {“success_fraction”:0,“report_to”:“cf-nel”,“max_age”:604800}
9. report-to: …
10. server: Cloudflare

Now, when I put it into an iframe, a redirect appears:

1. Status Code: 302
2. Remote Address: …
3. Referrer Policy: strict-origin-when-cross-origin

Response Headers (likely not important):

1. access-control-allow-credentials: true
2. alt-svc: h3=“:443”; ma=86400, h3-29=“:443”; ma=86400
3. cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
4. cf-ray: …
5. cf-team: …
6. date: Sun, 18 Dec 2022 18:52:43 GMT
7. expires: Thu, 01 Jan 1970 00:00:01 GMT
8. location: …
9. nel: {“success_fraction”:0,“report_to”:“cf-nel”,“max_age”:604800}
10. report-to: …
11. server: Cloudflare
12. vary: Accept-Encoding

PS. I want to point that in the headers there is nothing related to CSP (content security policy) and no x-frame-options.

Update: After looking here: Authorization cookie · Cloudflare Zero Trust docs
I realized that this is probably because of CORS (same site iframing works, but I need an iframe on other domain).

Update 2: I found settings for CORS in application tab in ZTN, probably that’s what I was looking for.
I believe I’ve checked all options, but CF_Authorization not passed in iframe and I still get 302 to mysubdomain.cloudflareaccess.com, and that domain is not embeddable. I’ve checked in chrome and firefox, and I can access non-iframed version perfectly, but not an iframed one.

My current setup:
Access-Control-Allow-Credentials: yes
Access-Control-Max-Age (seconds): 100
Access-Control-Allow-Origin: https://website-with-iframe-in-page.com
Access-Control-Allow-Methods: allow all
Access-Control-Allow-Headers: allow all

Same-site: None
HTTP Only: true
Enable Binding Cookie: false

[lopescostapedrohenri]

The same here. X-Frame-Options is set to DENY in Cloudflare headers.

Access (cloudflareaccess.com) is setting X-Frame-Options: DENY

For security reasons, by default the deny rules are defined; some domains allow you to do this like Youtube, or wikipedia, others for security reasons do not allow it. If the header is defined by Cloudflare, it may not allow other configuration; since it is a serious failure to allow frame from other domains.

Cloudflare zero trust - embedding of application dashboard in website

Hello, we’re using zero trust (aka all the other names) on a local app, and the tunnel and service is working well. Part of the application generates dashboards that can be embedded anywhere within an iframe, and that part isn’t working well for any person who isn’t logged into the application (e.g. logged in users can see the embedded dashboard, but visitors to the page just see an error that cloudflareaccess won’t connect). There are no security issues as the data is protected but ideally, we…

Cloudflare Access Content-Security-Policy Issue

For posterity you can find the documentation for CORS w/ Access in our Developer Docs

The Cloudflare team could perform the addition of a configuration for this issue. I have an Android app and I can’t access my secured sites from it as pretty much the entire Android framework uses iframes internally from the webview.