zachliu opened a new issue, #49895: URL: https://github.com/apache/airflow/issues/49895
### Apache Airflow version 3.0.0 ### If "Other Airflow 2 version" selected, which one? _No response_ ### What happened? It looks like Airflow 3.0.0 requires a "relaxed" `Content-Security-Policy` to display the "Security" pages (Users, Roles, Actions, Resources, Permissions). because when i have `frame-ancestors 'none'` I got ```Refused to frame 'https://my.domain.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".``` when trying to load any "Security" pages. I had to allow same-origin framing (`frame-ancestors 'self'`) in our ALB to be able to see these pages. More discussions are in this [slack thread](https://apache-airflow.slack.com/archives/CCQB40SQJ/p1745609330264279). ### What you think should happen instead? From the discussion, this might or might not be a bug. But it was not an issue before. ### How to reproduce Set `frame-ancestors 'none'` in the `Content-Security-Policy` and access one of the "Security" pages (Users, Roles, Actions, Resources, Permissions). ### Operating System ubuntu debian ### Versions of Apache Airflow Providers _No response_ ### Deployment Other Docker-based deployment ### Deployment details _No response_ ### Anything else? _No response_ ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
