Problem Framing Quick Base AppToken Page

  • 0
  • 1
  • Question
  • Updated 3 weeks ago
  • Acknowledged
  • (Edited)

For years, I've embedded the Quick Base AppToken page in a frame to provide instructions around it on how to add an AppToken.  This is to make it easier to use one of my add-ons that requires an apptoken.  I even took it as far as using JavaScript to add the apptoken for the user by driving the page, thus automating the process completely.

However, recently some customers have experienced a problem where the browser refuses to show the Quick Base page in the frame (i.e. "This content cannot be displayed in a frame").  I cannot reproduce the problem using IE, Firefox or Chrome.

Does Quick Base set the X-Frame-Options to DENY in certain situations?  What else could cause this problem?

Photo of Joe Acunzo

Joe Acunzo, Champion

  • 280 Points 250 badge 2x thumb

Posted 1 month ago

  • 0
  • 1
I do know that there is an option at the account level to prohibit redirects to external websites.

This was driving me crazy for hours until eventually Kirk Trachy saved me.

I’m not sure if this is related to your problem but there definitely is an account level switch for that if that helps. You need to contact support to have that Realm opened up to external redirects If that is the problem.
Photo of Joe Acunzo

Joe Acunzo, Champion

  • 280 Points 250 badge 2x thumb
Thanks Mark, you're close, but it's not the redirect setting.  I found out from support that it is a setting that explicitly prevents putting any Quick Base page into a frame.  Only available from what I can see in an Enterprise account, in the Security policies section of the page, you can enable an option named "Prevent embedding in iframes".  More details on this setting in the Quick Base help page found here:

https://help.quickbase.com/user-assistance/realm_security_policies.html
Thx for letting me know and maybe my response helped a bit.
Photo of Harrison Hersch (QB)

Harrison Hersch (QB), Quick Base Sr. Product Manager (Platform)

  • 1,530 Points 1k badge 2x thumb
Hey Joe/Mark - yea this is correct. The ability to put a webpage into another webpage is often considered a security risk. To meet our highest standards of security, we need this to be an option that enterprise customers can opt into when understanding the risks.
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
I have been trying to figure out how to do this and it would not work for me. Now I know why. It would be super helpful if there could be a main dashboard, maybe on the My Apps page, to display relevant reports from many apps that can be designed as default or per user.
Michelle,
Are you talking about being able to have a dashboard with reports from other Quick Base apps or other websites?
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
Other QuickBase Apps. I have tried the url buttons, I've tried the website widget...cannot get it to display. 
Why can’t you do a web widget? What’s the symptom of the problem?
You can also use a web widget to embed a whole dashboard in a dashboard. Suffix the URL with

&ifv=1

To hide the table headers.
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
This is what I see when I try to embed the whole dashboard...

https://bridgethesselink.quickbase.com/db/bn8n5ff7h&ifv=1
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
This is what I get when I try to embed a report from another app..
I can’t really read what it saying in the middle of your screenshot but in any event can you post the code you were using for the web widget?
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
https://bridgethesselink.quickbase.com/db/bpbqfmuij?a=q&qid=1&ifv=1

If I click the box on the upper right of the web widget window it opens the report on a new page, it just won't display it on the dashboard.

The small print says bridgethesselink.quickbase.com refused to connect.
Photo of Joe Acunzo

Joe Acunzo, Champion

  • 280 Points 250 badge 2x thumb
Michelle, from what you describe, and the screenshot, this is probably due to the same issue that I hit.  In that Quick Base realm, in settings in the Security policies section, the option "Prevent embedding in iframes" is probably enabled.  More details on this setting in the Quick Base help page found here:

https://help.quickbase.com/user-assistance/realm_security_policies.html

If you can, disable (i.e. uncheck) that option and see if it solves your problem.  Let us know.  Thanks.
I agree. If you can't find that setting, put in a support ticket to have iframes enabled for your Realm.  I did not consider the possibility that they were locked out for internal Quick Base apps.
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
I just sent a ticket, I don't seem to have a Security Policies section to try to change that setting myself. Hopefully they can fix it and I don't get a response saying that our subscription level doesn't get that feature...
Photo of Joe Acunzo

Joe Acunzo, Champion

  • 280 Points 250 badge 2x thumb
If your subscription doesn't have this feature ("Prevent embedding in iframes"), then you are experiencing a different problem than the one I encountered.
(Edited)
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
I will let you all know what the outcome is from the ticket in hopes to help anyone else with similar issues.
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
Support Response..."The account subscription is currently not high enough to view or change the Iframe embedding settings. As such, iframes embedding anything from Quick Base will be blank, including within Quick Base itself."
Photo of Joe Acunzo

Joe Acunzo, Champion

  • 280 Points 250 badge 2x thumb
I just created a test HTML page that embeds Quick Base into a frame.  You can take the HTML below and save to a file.  Change the Quick Base account to yours, open the file in your browser, and see what happens.  If it's blocked, sounds like that setting is enabled, and you need Quick Base support to disable it.  Let us know what happens.
<html>
<head>
<title>Quick Base in Frame</title>
</head>
<body>
<p>Here is Quick Base in a frame.</p>
<iframe height=400 src="https://YourQBaccountHere.quickbase.com"></iframe>;
</body>
</html>
(Edited)
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
Support was "misinformed" and let me know that it was not a manual option on my end but since I made a request they were able to enable the iframe feature within QuickBase apps :) It is now working and you have all helped create a dashboard monster ;) Thank you!!!
OK, good to know.  You can in fact embed dashboards in dashboards with that technique, so go crazy.
Photo of Joe Acunzo

Joe Acunzo, Champion

  • 280 Points 250 badge 2x thumb
Thanks for the update Michelle, and great news it's now working for you.  Though, odd that if it's not an Enterprise account, why this was even an issue.

But to clarify, you stated support was "able to enable the iframe feature".  I'm assuming they disabled the feature as when enabled, it prevents any Quick Base page from being in a frame.  Just semantics I guess.
(Edited)
Photo of Michelle Chapman

Michelle Chapman

  • 690 Points 500 badge 2x thumb
Yes, then they disabled the feature that prevents the page from showing in iframes. At least when you are doing it from App to App within your account, not necessarily externally. That is when you are suppose to have an Enterprise level account.