Is Canvas now blocking JavaScript in the pop-up embed windows?

[JustinMaier]

I have a course on Canvas where I heavily make use of revealjs to create HTML presentations for my class. I use HTML presentations in order to embed live code examples. 

To make them accessible on Canvas I've been uploading folders containing the necessary HTML, CSS, and JavaScript and library files into course files, and linking the HTML file for presentation to students in various Canvas pages. I've attached an example of how I do so.

Up until today (maybe yesterday?), this has worked great. The presentation will open in the embed window, render correctly and students were able to follow along and run the examples themselves. 

Now in Google Chrome, for me and students, presentations that previously worked now do not load, and only show an empty white screen. 

Testing the page in Firefox, I get an "access denied" message stating "You need to have JavaScript enabled in order to access this site"; I've attached an image of the error message.

Looking through the Firefox browser console, this appears to be the relevant error:

Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-ancestors) at <unknown> because it violates the following directive: “frame-ancestors 'self' https://sso.canvaslms.com https://sso.staging.canvaslms.com https://sso.beta.canvaslms.com https://sso.test.canvaslms.com https://sso2.canvaslms.com https://sso2.staging.canvaslms.com https://sso2.beta.canvaslms.com https://sso2.test.canvaslms.com https://a21271-1620654.cluster346.canvas-user-content.com”

Was there a recent change on Canvas causing this? If so, are there any ideas for how I can share these presentations with students via Canvas?

Thank you.

[pjoe]

I just had a similar issue. I have some single-page HTML pages that I upload to Canvas (syllabus, project assignments, etc.) which were working until now. Today I faced the "Access denied" message in the preview pop up.

I figured that it was because of the "strict" tracking protection in the Firefox settings. When going back to "normal", the problem disappear and the preview works as before.

See https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop?as=u&utm_source=in... to lower the tracking protection for a particular website.

Hope it helps!