This discussion revolves around the feasibility of embedding Discourse in an iframe. aarongray initiated the topic expressing a desire to integrate Discourse into their web app via an iframe. Initial concerns were raised by Mittineague regarding Cross Frame Scripting security risks, but proposed solutions involving trusted domain specifications using X-FRAME-OPTIONS headers ([/t/-/50405/3], [/t/-/50405/4]) were discussed. However, codinghorror explained that Discourse’s complex JavaScript-driven architecture makes iframe embedding inherently fragile as it expects tight browser control.
Several users ([/t/-/50405/6], [/t/-/50405/8], [/t/-/50405/18]) expressed specific use cases, such as embedding the Discourse calendar. A plugin ([/t/-/50405/12]) and hidden site settings ([/t/-/50405/13]) to allow iframe embedding were mentioned, but Yahia_Kala reported they didn’t resolve the issue for their forum ([/t/-/50405/16]), which wasn’t even loading ([/t/-/50405/17]). It appears a hidden setting allow_embedding_site_in_an_iframe exists that requires disabling CSP restrictions, but successful implementation remains challenging and potentially unstable.
I’m developing a web app, and I’d love to use Discourse as my forums / community discussion platform. One of my main requirements though is that the forum should be able to be opened in an iframe docked to the side of my UI, so that users can browse tutorials, talk to other people, or contact support all within the comfort of the app itself. This is a huge win for UX, and because Discourse is responsive and mobile friendly, a small iframe should work well for this use case. It seems like this would be an awesome feature for Discourse that many people might use.
So I wanted to ask the maintainers and folks here, is this a feature that you would be open to a PR for? Would you consider adding this feature? Are there any issues with that solution that was proposed that would need to be dealt with?
Yes, sending headers should take care of most if not all security risks.
(I say most because I don’t know if some older browsers might not use the headers)
Not being a developer, this thread leaves me puzzled about what the conclusion is regarding embedding discourse in an IFRAME. When you say:
This sounds to me like: problem solved, especially since - in my case - everything would not only be happening under the same domain but even on the same server. But my understaning is also that this is nevertheless not supported and therefore not recommended for people like me. But why? If trusted domains can be specified?
Because it’s an extremely fragile configuration. Discourse expects to control the browser tightly as a JavaScript app. This is not a static 1996 era web page to be slapped in an <iframe> willy-nilly, it’s far more complex.
There is a simple plugin. However, it doesn’t work. Can it be made workable with a simple change since it was updated 6 years ago?
# name: Allow iFrame embedding
# about: Changes X-Frame-Options so the site can be embedded
# version: 1
# authors: bex-team, riking,
Rails.application.config.action_dispatch.default_headers.merge!({'X-Frame-Options' => 'ALLOWALL'})
pasted the wrong URL - link fixed
