Why I could not use sameorigin instead, as the call comes from the same sub-domain?
That would work if, for all individual subdomains you’ll be using, they’ll be loading frames from the same subdomain.
Which, in the examples I gives above, I think it is the case, right (honest question)?
Indeed I basically only use reverse proxies to access to my QNAP and it’s various parallel services (Couch Potato, Sonarr, Transmission, etc…) which I don’t think would have such problem.
If I had to wager, I’d say yes. It looks like it’s loading them out of subdirectories: https://test.domain.com/apps/qdesk, https://test.domain.com/apps/netmgr, https://test.domain.com/malware_remover, etc., so sameorigin might just be what you need.
It seems indeed working, thanks!