Markdown preview doesn't work

[nhooyr]

#296 (comment)

[nhooyr]

Seems to be an iframe issue #296 (comment)

Maybe related to #1401

[ViRb3]

Apologies, the problem was in an inherited nginx config:

# XSS
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

Everything works after I cleared those headers. Feel free to close this issue.

[nhooyr]

Glad you figured it out.

[jgsun]

Apologies, the problem was in an inherited nginx config:

# XSS
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

Everything works after I cleared those headers. Feel free to close this issue.

I am wondering how to or where to clear those headers? Thanks you very mucy!

[miramar-labs]

It's still happening in the latest builds - any chance you could elaborate on the 'fix' mentioned above ?

[ViRb3]

I have a global nginx config called tls.conf which sets the following "security" headers:

# XSS
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";

These cause requests to be blocked by the browser while using code-server, resulting in the issue here. To fix it, simply don't set or clear the three headers mentioned above. For example:

server {
    server_name foo.bar;

    location / {
        # override from tls.conf
        # required for Markdown preview
        add_header X-Frame-Options "";
        add_header X-Content-Type-Options "";
        add_header X-XSS-Protection "";

        proxy_pass http://code-server:8080;
    }

    listen 443 ssl http2;
    include presets/tls.conf;
}

Hope this makes sense.