CORS Error when embedding comments in Gitlab-hosted Jekyll static site

Support

AI-generated summary

The user chrishiero is experiencing a CORS error when trying to embed comments from their Discourse instance (http://discuss.singlebagtravel.com) into their Jekyll static site hosted on Gitlab (http://singlebagtravel.com).

They have set DISCOURSE_ENABLE_CORS: true in the app.yml file and added http://singlebagtravel.com to the CORS origins settings. However, they are still encountering an error.

codinghorror suggests adding both the domain and subdomain to the CORS settings, but this does not resolve the issue for chrishiero.

The problem is eventually solved when chrishiero discovers a hidden “Save Embedding Settings” button at the bottom left of the settings page, which is required to apply the changes. They also needed to enter a username. chrishiero finds this save button to be unintuitive and notes that it is not mentioned in any guides.

1

New Discourse user here just trying to get a basic site skeleton up. So far, almost everything has been smooth except for getting the comment-embedding/post-generating functionality to work.

I have my Discourse instance running on a Digital Ocean droplet, as per the setup instructions.

My discourse url is: http://discuss.singlebagtravel.com
My static site is located at: http://singlebagtravel.com

I have added: DISCOURSE_ENABLE_CORS: true to the app.yml file and re-launched.

I have set Settings > Security > cors origins to: http://singlebagtravel.com

The console on my static site where I embed the comments shows this:

Failed to execute ‘postMessage’ on ‘DOMWindow’: The target origin provided (‘http://discuss.singlebagtravel.com’) does not match the recipient window’s origin (‘http://singlebagtravel.com’)

There are a number of similar posts that I found in the forums that have helped me get this far, but none of the solutions suggested in any of them have worked for me. I feel like I may be missing something obvious here, because it seems like it should work.

Thanks!

2

Looks like you need to add both domain and sub domain in your cors settings then?

3

@codinghorror Seems like that should have solved it, but the error is the same even with http://discuss.singlebagtravel.com added to cors origins.

4

Turns out it was a ridiculously simple mistake - apparently there is a “Save Embedding Settings” button at the very far bottom left of the screen on the settings. Even though it looks like clicking the blue check mark next to the host does the “save”, you still need to find that save button and click it.

Additionally, once I did find it I was alerted to the fact that I needed to enter a username.

Honestly, that save button is really unintuitive - it is difficult to find, there is no penalty for not hitting it, the page seems to save my settings regardless (but not apply them I guess?) and none of the guides on this mention that I need to find it and hit it.