Tanzu Apps Manager disallows embedding using content-security-policy header

Products

• VMware Tanzu Platform Core
• VMware Tanzu Application Service

Issue/Introduction

Operators wants to know how this be augmented to allow listed domains so that Apps Manager dashboard can be embedded cross-domain.

Tanzu Apps Manager dashboard produces the following content-security-policy header which prevents embedding:

Symptoms:

content-security-policy: frame-ancestors 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; font-src * data:; connect-src *; img-src * data:; default-src 'self' 'unsafe-inline' 'unsafe-eval' data:;

 

Environment

Product: Tanzu Elastic Application Runtime

Component: Tanzu Apps Manager

Cause

Apps Manager's current configuration with the frame-ancestors and x-frame-options of same-origin explicitly disallows embedding Apps Manager for cross domain purposes. Embedding is intentionally disallowed to enhance security against potential attacks utilizing embedded websites.

Resolution

Enabling content-security-policy for the purpose of embedding Apps Manager is intentionally disallowed for security purposes.

If you need this capability then please raise a feature request with your account team. Reference: Contact Broadcom Support