topic Re: Power BI On Premise Report Server X-Frame-Options in Report Server

Power BI On Premise Report Server X-Frame-Options

vlemon — Fri, 19 Feb 2021 09:19:05 GMT

Hi,

We are trying to access parent HTML elements using Custom Visualization but cannot access them because X-Frame-Options security.

We tried to add Content-Security-Policy in the web config file available at the following location, but it is not working any suggestion.

C:\Program Files\Microsoft Power BI Report Server\PBIRS\ReportServer

Re: Power BI On Premise Report Server X-Frame-Options

d_gosbell — Mon, 22 Feb 2021 04:28:04 GMT

This is by design. Custom visuals run inside a restricted "sandbox" and they are not allowed to interact with any of the parent html elements

Re: Power BI On Premise Report Server X-Frame-Options

jwu — Mon, 02 May 2022 21:14:19 GMT

As what I observed, the on-premises PBI version and SSRS 2016+ version have this response header (X-Frame-Options) added on. However, the PBI.com does not have the same header. On the other hand, the older SSRS version 2014 or earlier do not have the same header. If it is the security concern, it should apply across the versions. Also, AD FS 2019 is still allowing to remove the header (https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/customize-http-security-headers-ad-fs). I need to know how to remove the header for on-premises PBI and SSRS 2019 since we are hosting them internally and locked down all the securities. Any help will be appreciated.