(Came to my attention via ZenDesk, verified by Scott " took a look at this and saw that the site is working fine, BUT the admin url is not.")
Boone, do you see a problem? Thanks!!
#2 Updated by Boone Gorges over 5 years ago
- Status changed from New to Resolved
- Target version set to Not tracked
Sorta. It appears that the brooklynwaterfront.org domain itself is not actually hosted at the Commons. It's on a different IP (22.214.171.124). That server loads a webpage that contains nothing but an iframe, and the iframe contains the content of http://bwrc.commons.gc.cuny.edu/, which is hosted on the Commons. As such, brooklynwaterfront.org/wp-admin is not a real page. For security reasons, WordPress does not allow the Dashboard to be loaded inside of an iframe.
If the admin of brooklynwaterfront.org would like to be able to administer the site under brooklynwaterfront.org/wp-admin, the domain will have to be mapped to the Commons, as per our normal procedures. Otherwise, the Dashboard is accessible via https://bwrc.commons.gc.cuny.edu/wp-admin.
#4 Updated by Boone Gorges over 5 years ago
I don't think so. WordPress sends a same-origin header to the browser, which prevents the browser from accepting cookies from *.commons.gc.cuny.edu domains if the URL in the location bar doesn't match the *.commons.gc.cuny.edu policy. In other words, it's not possible to be logged into the Commons when the Commons is being shown in an iframe on a site with a non-Commons domain. This mitigates all the obvious security issues (cookie forgery, CSRF, etc).
#7 Updated by Boone Gorges almost 4 years ago
- Assignee changed from Boone Gorges to Marilyn Weber
Marilyn, you've been added as an administrator on https://bwrc.commons.gc.cuny.edu/
As far as I can tell, the site is still configured in the way described above https://redmine.gc.cuny.edu/issues/5319#note-2. Browsers may or may not block the content of the embedded iframe, depending on security policies. I do see that the iframe code is referencing http://bwrc... rather than https://bwrc (note the 's'). It could be that changing that value will be enough to placate browser policies.