Embed Kibana Dashboard via IFrame / csp config

[ksremo]

hi i want a third webserver to embed a dashboard via iframe, but default csp config denied it.
what i tried so far in the kibana.yml
xpack.security.sameSiteCookies: None
xpack.security.secureCookies: true
csp.strict: false
server.securityResponseHeaders.disableEmbedding: false
csp.rules: ["default-src *"]
#csp.rules: ["default-src https://urlthatembeds.local/"]
#server.customResponseHeaders: {"x-frame-options":"allow-from https://urlthatembeds.local/ "}
server.customResponseHeaders: {"x-frame-options":"allow-from *"}

But it seems that always "x-frame-options: SAMEORIGIN" is sent (but also the custom header)

how to allow these iframes?

[azasypkin]

@ksremo

but default csp config denied it.

What exact error do you observe? Do you see the same behavior in different browsers (e.g. Firefox vs Chrome)?

[ksremo]

i could solve the problem.
problem was the nginx reverse proxy in front of kibana. he adds "x-frame-options: SAMEORIGIN" header.

[azasypkin]

Ah, nice, thanks for sharing!