@florianjacob opened this issue on April 16th 2015

Firefox only shows an empty space instead of the opt-out iframe when loading it from another domain, using piwik 2.12.1 and firefox 37.0.1. Probably a problem with the X-Frame-Options setting, I checked headers with curl -I and it seems like X-Frame-Options is empty for the iframe url, while being set to sameorigin for other urls. Just tried with oxfam.de, same result:

$ curl -I "https://www.oxfam.de/piwik/index.php?module=CoreAdminHome&action=optOut&language=de"
Date: Wed, 15 Apr 2015 21:47:00 GMT
Server: Apache
Cache-Control: no-storPragma: 
Expires:e, must-revalidate
X-Frame-Options: 
[..]
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=utf-8

$ curl -I "https://www.oxfam.de/piwik/index.php"
HTTP/1.1 200 OK
Date: Wed, 15 Apr 2015 21:48:46 GMT
Server: Apache
Cache-Control: no-store, must-revalidate
X-Frame-Options: sameorigin
[..]
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=utf-8
@florianjacob commented on April 16th 2015

Found the relevant code, it is intentional to send an empty x-frame-options: https://github.com/piwik/piwik/blob/3838/core/View.php#L244

Not sure whether the empty X-Frame-Options is the actual reason for firefox not displaying the iframe, though.

@florianjacob commented on April 24th 2015

Found the solution: It's not Firefox, it's the adblocker filter lists I use there, which also contain generic matches for urls starting with piwik. TIL.

This issue was closed on April 24th 2015
Powered by GitHub Issue Mirror