Help request: All shortened links result in "connection refused"

[punk-t]

Hi all,

as said in the title already, all created short links to any random test pages I own result in a connection refused error.

I upgraded an YOURLS installation from 1.8.1 to latest. It runs as a sub domain like 'https://short.fancydomainhere.de'. I for example try to shorten an public deep link to my Nextcloud installation ('https://cloud.fancydomainhere.de/verydeeplink') on the same server. YOURLS created a short link sucessfully, but when I try to use this short link an error message says 'cloud.fancydomainhere.de refuses connection'.

I did some frame/iframe examination with chrome dev tools and found a maybe more helpful description:

Refused to frame 'https://cloud.fancydomainhere.de/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".

Here are the default headers of the web server:

Default Headers:
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block

I'm sure I misconfigured or forgot something.

Does anyone have an idea?

Thanks in advance
Thomas

[dgw]

I'm sure I misconfigured or forgot something.

The error you found in Dev Tools explains where to look. If you are using some YOURLS plugin that displays the remote page inside a frame (e.g. the built-in Toolbar one or a derivative), that would cause this error.

I don't think this is solvable through YOURLS; the page being framed has to allow that usage in its Content Security Policy (CSP) header and/or CORS configuration, which is well outside the scope of what YOURLS can control.

This is probably coming from the Nextcloud side, so I took the liberty of finding what looks like a relatively simple, related forum thread: https://help.nextcloud.com/t/implement-iframe-on-nextcloud-24/142216/2

[punk-t]

I knew, it was a simple one. Thanks a lot, simply deactivating toolbar did deactivate the iframe - and I could have read it on my own... Sorry :)