Cannot add html5 widget

[RedCat]

I am trying to add a widget with a noVNC page, but when adding a widget it does not show anything, I see such messages in the browser console:

Blocked script execution in 'http://192.168.8.105:6081/vnc.html?host=192.168.8.105&port=6081' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
192.168.8.105:6081/vnc.html?host=192.168.8.105&port=6081:1 Blocked script execution in 'http://192.168.8.105:6081/vnc.html?host=192.168.8.105&port=6081' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
vnc.html:1 Access to script at 'http://192.168.8.105:6081/app/error-handler.js' from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
vnc.html:47          GET http://192.168.8.105:6081/app/error-handler.js net::ERR_FAILED 200 (OK)
vnc.html:1 Access to script at 'http://192.168.8.105:6081/app/ui.js' from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
vnc.html:48          GET http://192.168.8.105:6081/app/ui.js net::ERR_FAILED 200 (OK)
vnc.html:1 Access to font at 'http://192.168.8.105:6081/app/styles/Orbitron700.woff' from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
base.css:1          GET http://192.168.8.105:6081/app/styles/Orbitron700.woff net::ERR_FAILED 200 (OK)
vnc.html:1 Access to font at 'http://192.168.8.105:6081/app/styles/Orbitron700.ttf' from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
base.css:1          GET http://192.168.8.105:6081/app/styles/Orbitron700.ttf net::ERR_FAILED 200 (OK)

line: define('ZBX_IFRAME_SANDBOX', 'allow-scripts');
added to the file defines.inc.php
What haven't I done yet?
P.S.
Zabbix version: 6.0.13

[markfree]

Usually you can unchek the "Use iframe sandboxing" and "Use X-Frame-Options HTTP header" "to disable putting the retrieved URL content into sandbox (not recommended)".


But see Best practices for secure Zabbix setup.