Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.
Bug 445888 - X-Frame-Options break links from Eclipse Help to any page on eclipse.org when using external browser
Summary: X-Frame-Options break links from Eclipse Help to any page on eclipse.org when...
Status: CLOSED FIXED
Alias: None
Product: EMF
Classification: Modeling
Component: Doc (show other bugs)
Version: unspecified   Edit
Hardware: All All
: P3 major (vote)
Target Milestone: ---   Edit
Assignee: Nick Boldt CLA
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-03 10:56 EDT by Pierre-Charles David CLA
Modified: 2015-07-27 03:26 EDT (History)
4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Pierre-Charles David CLA 2014-10-03 10:56:19 EDT 
The Eclipse Help uses frames to show the contents, but when using an external browser, any link from the help contents into a page at eclipse.org is (silently) broken.

Steps to reproduce:
1. Install a fresh Luna Modeling package (I use the Modeling package because I know EMF at least has some external links, but there is nothing specific to modeling).
2. Window > Preferences > Help > Open Help Contents: choose "In External Browser" (in my case, this is "Chromium Version 37.0.2062.120 Ubuntu 14.04 (281580) (64-bit)".
3. Go to Help > Help Contents > EMF Developer Guide > Online Docs. Try to click on the "FAQ" link. Nothing happens.

The browser's console tells me it "Refused to display 'https://wiki.eclipse.org/EMF/FAQ?cp=10_2_0' in a frame because it set 'X-Frame-Options' to 'DENY'."

Opening the link explicitly in a new tab (with target="_blank" or "Open in new Tab") works, but requires changing the doc itself (obviously not an option for anything already released).
Comment 1 Eclipse Webmaster CLA 2014-10-06 16:18:44 EDT 
This sounds like an issue with the EMF docs, so I'm re-assigning it.

External content should be opened in a new tab, since malicious inline framing is the issue the X-Frame-Options was created to try and mitigate.

-M.
Comment 2 Ed Merks CLA 2015-03-31 07:06:09 EDT 
The fix is committed to master.
Comment 3 Ed Merks CLA 2015-07-27 03:26:39 EDT 
The fix is available in the 2.11 (Mars) release.