Allow navigation outside iframe

Hello!

I have a dashboard running at Visual Vocabulary - a Hugging Face Space by vizro which contains links to some pages on GitHub, e.g.

<a href="https://github.com/mckinsey/vizro">Vizro</a>

When I click this link it doesn’t work inside the iframe because GitHub sets X-Frame-Options: deny.

Hence I’ve added target="_top" (or target="_parent") to the link to try and open it outside the iframe.

Unfortunately this doesn’t work. Chrome says:

Unsafe attempt to initiate navigation for frame with origin 'https://huggingface.co' from frame with URL 'https://vizro-demo-visual-vocabulary.hf.space/'. 
The frame attempting navigation of the top-level window is sandboxed, but the flag of 'allow-top-navigation' or 'allow-top-navigation-by-user-activation' is not set.

Looking at the space source, the iframe looks like this:

<iframe src="..." sandbox="allow-downloads allow-forms allow-modals allow-pointer-lock allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-storage-access-by-user-activation"></iframe>

Is there any chance that allow-top-navigation or allow-top-navigation-by-user-activation could be added here so that it’s possible to do this? Otherwise, as it stands it’s impossible to link to some websites (such at GitHub) from inside a HF space.

(I know it’s possible to also view the dashboard directly through “Embed this space” but it would be great if this also worked from the iframe view.)

Thank you!

1 Like

Looks like a Google issue.

I don’t think it’s a Google issue. Everything is behaving correctly as per the iframe’s settings. The way to fix this would be to change the iframe’s settings to include allow-top-navigation or allow-top-navigation-by-user-activation.

1 Like

Oh it’s not Gradio, it’s Vizro. I found some issues.

This isn’t a Vizro issue either (for context I’m a maintainer of Vizro). The same issue would happen with Gradio or indeed just a static page hosted in Hugging Face spaces. The iframe in question is not part of the app I’ve written; it’s provided by Hugging Face, and the only way to solve this is by changing the code that’s owned by Hugging Face.

If this is the wrong place to communicate with the people who run HuggingFace then please do say!

P.S. I like your cat.

1 Like

It looks like there used to be a modified component for Gradio.
If you want to contact HF staff, Discord is the fastest way.
This cat looks like my old cat, but he is a famous talent cat who passed away a long time ago. His name is Nyaran.

Gradio has a dedicated community, but even outside of that there are basically many active HF users.

1 Like

Just to close the loop on this ask - we recommend opening links in a new tab. The current settings are intentional for security reasons.

Super cool space, though @antonymilne! :heart_eyes: :chart_with_upwards_trend:

1 Like