Nova Iframe Page Laravel Package

Getting Started

Install the package:

composer require pavloniym/nova-iframe-page

Start with the package README, then inspect src/ for the page class and any config file. Register the page in app/Providers/NovaServiceProvider.php using Nova’s page registration (Nova::pages([...]) on Nova 4+, or the pages() array on older versions). Configure the iframe target URL and navigation label.

First use case: embed an internal dashboard, documentation site, or metrics tool directly inside Nova so users do not leave the admin panel.

Implementation Patterns

• Single embedded page: register one page class with a fixed URL for a common internal tool.
• Multiple pages: create one page class per embedded tool; set $name, $uriKey, icon, and URL per class.
• Dynamic URLs: resolve the iframe URL from config(), environment variables, or the authenticated user/tenant. Keep secrets out of URLs.
• Authorization: override the page’s authorize() method or use Nova gates to restrict who can see each embedded tool.
• SSO/authenticated targets: prefer same-site cookies or signed/temporary URLs when the framed app requires authentication.
• Local development: point the iframe at a local URL only when Nova itself is served over HTTP; HTTPS Nova cannot frame HTTP content.
• Testing: assert page registration and URL resolution in unit tests, then verify framing behavior manually in the browser.

Gotchas and Tips

• X-Frame-Options / CSP: the target app must allow framing. Set Content-Security-Policy: frame-ancestors 'self' https://nova.example.com or remove X-Frame-Options: DENY.
• Mixed content: an HTTPS Nova instance cannot iframe an HTTP URL. Use HTTPS everywhere.
• Third-party cookie restrictions: SSO inside iframes can fail due to cookie SameSite and browser blocking. Same-site subdomains are the safest deployment.
• Do not put tokens in query strings: use server-side proxying or short-lived signed URLs instead.
• Iframe sizing: ensure the surrounding container gives the iframe height; some embeds need explicit width: 100%; height: 100%.
• Nova compatibility: check composer.json constraints for the supported Nova major version before upgrading.
• Debugging: browser console shows Refused to display... for frame blocks; inspect the target’s response headers and the network tab.
• Extension points: override page methods such as name(), url(), and authorize() rather than editing vendor files.
• v1.0.0 is the initial release: pin the version and review the changelog before upgrading.