The viewer linked to glTF Asset Generator is out of date

[playcanvas]

The viewer linked to glTF Asset Generator is out of date

[cx20]

It seems that it was merged into engines.json, but the viewer doesn't seem to display properly.
PlayCanvas Viewer doesn't seem to work properly with iframe.

https://bghgary.github.io/glTF-Assets-Viewer/?manifest=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Manifest.json&folder=19&model=0

<iframe src="https://playcanvas.com/viewer/?assetUrl=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Node_Attribute/Node_Attribute_00.gltf&cameraPosition=0,20,-20">
</iframe>

Mixed Content: The page at 'https://bghgary.github.io/glTF-Assets-Viewer/?manifest=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Manifest.json&folder=19&model=0' was loaded over HTTPS, but requested an insecure frame 'http://playcanvas.com/viewer?assetUrl=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Node_Attribute/Node_Attribute_00.gltf&cameraPosition=0,20,-20'. This request has been blocked; the content must be served over HTTPS.

[willeastcott]

I'm not sure where the http protocol is being used (instead of https). In the engines.json, I used https.

[cx20]

I tried the iframe in jsfiddle and the Babylon.js and three.js viewers seemed to be able to display in the iframe as well.
I think it's a problem with some settings on the PlayCanvas Viewer side, but I didn't understand the cause.

https://jsfiddle.net/cx20/jszda6fu/9/

<!-- Babylon.js -->
<!--
<iframe src="https://sandbox.babylonjs.com/index.html?assetUrl=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Node_Attribute/Node_Attribute_00.gltf&cameraPosition=0,20,-20&kiosk=true"></iframe>
-->
<!-- PlayCanvas.js -->
<iframe src="https://playcanvas.com/viewer/?assetUrl=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Node_Attribute/Node_Attribute_00.gltf&cameraPosition=0,20,-20"></iframe>
<!-- three.js -->
<!--
<iframe src="https://gltf-viewer.donmccurdy.com/#model=https://raw.githubusercontent.com/KhronosGroup/glTF-Asset-Generator/master/Output/Positive/Node_Attribute/Node_Attribute_00.gltf&cameraPosition=0,20,-20&kiosk=true&preset=assetgenerator"></iframe>
-->

[willeastcott]

Yeah, this is probably something configured on playcanvas.com to prevent other sites iframing pages. @yak32 @slimbuck @vkalpias Would it be possible to relax this just for the viewer?

[slimbuck]

Removing the params from the fiddle URL gives this slightly more useful error:
Refused to display 'https://playcanvas.com/viewer' in a frame because it set 'X-Frame-Options' to 'deny'.

[yak32]

yes, we set X-Frame-Options to deny explicitly, to avoid click-jacking attacks, but we can whitelist certain websites.

[yak32]

we are going to whitelist the site soon.

[cx20]

Thank you for your cooperation. I have confirmed that the viewer is displayed.