- Verschifft
- 24. September 2026 um 07:17 UTC
- Autor
- Kamo
- Ausschuss
- 1753643
The launch screen put the session in a full-viewport iframe so the tab would keep the organization's icon and title instead of Guacamole's. It cannot work, and as shipped it reintroduced the black screen this whole change set exists to remove. The gateway's Traefik chain (hc-chain -> hc-headers) sets X-Frame-Options: DENY on every route to computers.*, the one carrying the session token included. A browser therefore refuses the frame — and because Chrome fires `load` on the refusal, the frame revealed itself anyway as a black rectangle over the whole tab. The comment on it said the header had been "checked rather than assumed". Guacamole itself was checked, and it does send no such header. The header is added in front of it, so the wrong hop was measured. Relaxing it was considered and rejected rather than skipped. X-Frame-Options has no usable allow-list, so it would mean frame-ancestors, and every Kamo route is a HostRegexp(^sub[.].+$) — the app answers on any organization's domain. There is no list of parent origins to write, only `https:`, which is not a policy. The organization's icon belongs at the gateway instead, where the Host says which organization is asking. So the tab says it is connecting and then navigates, as it did before the frame. The two tests that asserted the framing are replaced by one that fails if a frame ever comes back, and frameLabel leaves LaunchCopy with its last use. The key stays in the dictionary: only keys a component CALLS have to exist, and deleting one would churn 22 locale files the translation service owns.