I am re-opening again this topic to check if there a feasible solution for this, or it is not possible. Our customer leitmotiv is trying to access his internal website however it is blocked.
Description
I setup a document with an external link (website). On track in I wish to see on the document the website I added.
However, is it possible to share an understanding why in some cases the website appears whilst in other seems to be the website refusing the connection? Is it a missing security token, or is it by design like so, or some site can be accessed…
I remember this discussion via teams and one of the answers that seem to be the solution was this one:
"
The reason can be a bit more technical. It is possible that the system will not render the external page, because the website was not configured as an “Allowed Origin” in the CORS Security setting when installing the environment through DevOps Center ( Installation - Critical Manufacturing Documentation Portal )
This also depends on whether the external site allows its content to be framed. Some sites allow their pages/files to be displayed inside an iframe, while others explicitly block it, and in that case the browser shows the “refused to connect” message instead of the document.
You can check whether a given site allows it with these steps:
Press F12 to open the Developer Tools.
Display the Document in MES (as you did)
If the site blocks embedding, you’ll see a message in the console such as: Framing '<url>' violates the following Content Security Policy directive: "frame-ancestors 'self'". The request has been blocked.
or Refused to display '<url>' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
In the case I tested, the site returns frame-ancestors 'self', which means it only allows itself to embed its own pages. This is a restriction set by the external site, so there’s nothing we can change in the MES to work around it.
If the document is being hosted by the customer, they can also change the properties to allow being framed.
