- How do I install metrixinfo/nova-iframe in a Laravel Nova application?
- Install it with Composer using composer require metrixinfo/nova-iframe, then use the field or card class directly in your Nova resource or dashboard. There are no migrations, config publishing steps, or service providers with side effects, so the install is purely additive. Before installing, open vendor/metrixinfo/nova-iframe/composer.json and confirm the laravel/nova version constraint matches the Nova major you actually run, because micro-package READMEs are often stale. Rollback is simply removing the dependency line and the field usage.
- Does metrixinfo/nova-iframe support Laravel Nova 4 or Nova 5?
- Do not assume it does. Nova 4 moved to Vue 3 and changed asset registration, and a package at this adoption level (single maintainer, low star count, no visible CI or changelog) has very likely not tracked that migration. Grep the compiled Vue bundle for new Vue or Vue.component calls to confirm which Vue major it was built against. If it targets Vue 2, it will not register on Nova 4 or later and you would need to rebuild the asset inline or fork it as a first-party field.
- How do I add an iframe field to a Nova resource with nova-iframe?
- Add the package's iframe field class to the fields() method of the resource where you want the embedded content to appear, then configure the URL and height fluently. The package exposes a simple fluent API, so a single field entry is usually all that is required. Keep it to detail views and read-only contexts; do not try to use it for create or update workflows, since an iframe cannot participate in Nova form state or validation.
- Can I use nova-iframe as a Nova dashboard card instead of a resource field?
- Yes, the package is designed to work as both a resource field and a dashboard card. Adding a card is useful when you want a status page, monitoring console, or analytics dashboard visible on landing rather than buried in a detail view. The tradeoff is that a dashboard card loads on every visit to the dashboard, so confirm the target origin responds quickly and permits framing before making it the default landing experience.
- How do I configure the iframe height and width in nova-iframe?
- The package exposes height and dimension options through its fluent API, so you set them directly on the field or card definition rather than in a config file. Pick a fixed height that matches the embedded tool's layout, since iframes do not auto-size to remote content. If the target page is responsive, a generous height with a scrollbar is usually better than a tight one that clips the content.
- Why is my Nova iframe blank or refusing to display the page?
- The most common cause is the target origin blocking framing. Run curl -sI <target-url> | grep -iE 'x-frame-options|content-security-policy' and check for DENY or SAMEORIGIN, or a CSP frame-ancestors directive that excludes your Nova host. If the target refuses framing, no amount of Nova or package work will fix it and you should fall back to a link-out in a new tab. The second common cause is your own Content-Security-Policy frame-src allowlist not including the target origin, which must be updated in the same deployment.
- Does nova-iframe pass the Nova session or authenticate against the embedded site?
- No. The package is a thin presentation-layer field that renders an iframe; it cannot propagate your session, authenticate against the target, transform data, or handle write-back. Cross-origin iframes do not receive your Nova session cookie, so any embedded tool must be independently authenticated or publicly readable. If the target needs your Laravel session, an iframe is the wrong mechanism and you should use a short-lived signed URL or a direct API/JavaScript integration instead.
- Is embedding iframes in Nova resource index views a good idea with nova-iframe?
- Generally no. An iframe per row fires one third-party request per record, so a 50-row index page triggers 50 external loads and will visibly degrade the admin panel. Restrict the field to detail views or a single dashboard card. This is a usage-discipline risk you control rather than a defect in the package.
- What are the security concerns with the nova-iframe field?
- The sandbox, allow, and referrerpolicy attributes are likely unset, and if the URL is derived from record data an unescaped src binding becomes an injection vector. Avoid javascript: and data: schemes by validating any user-supplied URL, and prefer a fixed, trusted origin per field. Also watch for mixed http:// content, which browsers silently block inside an HTTPS Nova admin. Reviewing and hardening these attributes is your responsibility regardless of what the vendor ships.
- Is metrixinfo/nova-iframe safe to depend on in production, or should I fork it?
- Treat it as adopt-and-pin or fork, not as a long-term trusted dependency. It has a single maintainer, minimal adoption, no evident CI or changelog, and the code is only about 50 lines of PHP plus a compiled Vue asset, so the blast radius of abandonment is small and the fork cost is roughly one to two engineer-days. Pin the exact version and name an internal owner before piloting. If you need it to survive Nova majors, forking as a first-party field is often the cheaper long-term choice.