Solve the SAMEORIGIN error when iframe is embedded in VMware vRops

Prospect:

Brief description:

When using an iframe to embed a dashboard shared by VMware vRops (vRealize Operations Manager), an error message "xxx rejected our connection request" appears on the page. Check the console prompt "Refused to display 'https://***/' in a frame because it set 'X-Frame-Options' to 'sameorigin'."

This error is due to the fact that VMware vRealize Operations sets the X-Frame-Options header information to SAMEORIGIN by default, which prevents pages under other domain names from embedding this page, so the shared dashboard cannot be embedded in an iframe. This is for security reasons to avoid unnecessary cross-site scripting attacks (XSS attacks). You can try the following methods to resolve this issue:

1. Set vROps' X-Frame-Options to ALLOW-FROM to allow specific websites or domains to embed vROps shared dashboards in iframes.
2. Try using a reverse proxy service, such as Nginx or Apache, to embed the vROps shared dashboard into your website.
3. Another solution is to use a browser plug-in such as "Ignore X-Frame-Options Header" to ignore the frame policy.

After searching, I noticed that there is another way to modify the dashboard settings by using the REST API (vRealize Ops API) of VMware vRealize Operations, and use the curl command to access the REST API of vRealize Operations. Specify the ID of the dashboard to be updated, the Authentication Token, and the settings to be changed in the curl command. However, this method seems to be more cumbersome. Here it is introduced. Friends who like to toss can refer to it. The documentation of vRealize Ops API can be accessed.https://vRopsIPaddress/suite-api/docs/rest/internal_index.htmlYou can also refer to VMware’s official documentation.vRealize Operations Manager API Programming Guide

Example given by the smart assistant:

curl -i -X PUT -H "Content-Type: application/json" -H "Authorization: Basic $(echo -n 'admin:your_password' | base64)" -d '{"allowedOrigins":["https://your-domain.com"]}' https://localhost/suite-api/api/settings/security/same-origin

It's important to note that these workarounds may increase security risks, so carefully weigh the pros and cons before implementing them.

Text:

1. Use plug-ins

Through testing, using the plug-in can indeed directly ignore the X-Frame-Options header information security settings set by the server. The recommended plug-in name is: "Allow X-Frame-Options" Version: "0.1.0" Edge can directly search for the extension installation in the app store, Chrome You can also use Edge to install the plug-in first and then "transfer it" to Chrome. The Edge extension directory is usually inC:UsersAdministratorAppDataLocalMicrosoftEdgeUser DataDefaultExtensions

After installation, click the plug-in icon to open it to test whether X-Frame-Options can be blocked.

Using plug-ins is simple and effective, but it may not achieve the goal for different applications or projects. The solution once and for all is to modify the server security configuration↓

2. Modify server configuration

Please note: This method is only available invRealize-Operations-Manager-8.5.0.18255622andvRealize-Operations-Manager-8.2.0.16949153After testing, other versions or similar products may require different configuration files to be modified.

You should keep a backup before modifying any configuration, preferably by creating a snapshot or clone of the management VM! ! !

Since it uses the Apache+Tomcat architecture, it has been modified after testing./usr/lib/vmware-vcops/tomcat-web-app/webapps/ui/WEB-INFThe web.xml file in the directory can achieve the purpose

Openweb.xmlfile to edit. exist<web-app>Add the following code inside the tag:

Editingweb.xmlFile, you need to pay attention to retain the default configuration items. Depending on the version of Tomcat used, there may be different default configurations. If you are not familiar with the operation of configuration files, be sure to modifyweb.xmlPerform a backup before editing the file.

This code will use Apache Tomcat’s ownHttpHeaderSecurityFilterfilter, disable X-Frame-Options, and allow all sources to embed vROps shared dashboards. Please note that this change is a security risk as it makes your site vulnerable to clickjacking attacks. If you need more security, use more secure settings.

Save the changes and restart the VMware vRealize Operations virtual machine to test whether they take effect. Although it is possible to passsystemctl restart httpd or service vmware-vcops --full-restart Wait for the command to restart the service. It is recommended to restart the vRops virtual machine after the modification is completed to verify the modification. Simply restarting the service sometimes does not take effect and errors are found.

Extra:

1. How to share the dashboard:

Log in to vRealize Operations Manager and click "Dashboard". Click the dashboard that needs to be shared in the list on the left. After clicking and opening it, a sharing button will be displayed in the upper right corner of the right side of the page. Click this button to generate a sharing connection and set the corresponding sharing method. and validity period.

2.vRealize-Operations-Manager-Appliance deployment file

Include:

vRealize-Operations-Manager-Appliance-8.2.0.16949153_OVF10.ova

vRealize-Operations-Manager-Appliance-8.5.0.18255622_OVF10.ova

Download address: