# Allowed iframes whitelist not working - 'x-frame-options: SAMEORIGIN'

**URL:** https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545
**Category:** Support
**Created:** [June 30, 2022, 9:24am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545 "2022-06-30T09:24:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![boazcstrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/boazcstrike/32/262713_2.png) [@boazcstrike](https://meta.discourse.org/u/boazcstrike)
#### Post date: [June 30, 2022, 9:24am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545/1 "2022-06-30T09:24:06Z")

</div>

The allowed iframes whitelist is not working for us. We’ve added a github plugin with `plugin.rb`:

```plaintext
Rails.application.config.action_dispatch.default_headers.merge!({'X-Frame-Options' => 'ALLOWALL'})
Rails.application.config.action_dispatch.default_headers.merge!({'Access-Control-Allow-Origin' => '*'})
Rails.application.config.action_dispatch.default_headers.merge!({'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS, DELETE'})
Rails.application.config.action_dispatch.default_headers.merge!({'Access-Control-Allow-Headers' => 'Content-Type, Authorization, X-Requested-With'})

```

but for some reason, discourse keeps reverting it back to  
`x-frame-options: SAMEORIGIN`  
 ![image](https://global.discourse-cdn.com/meta/original/4X/9/6/0/96000ee84c62420a94623848fdf044c62bf9c862.png)

Everything works in http localhost but when deployed in https, nothing is working.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 30, 2022, 9:34am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545/2 "2022-06-30T09:34:32Z")

</div>

Hello and welcome @boazcstrike 🙂

I think there was a similar issue in this recent post [Iframe allow attribute not working - #13 by gilby](https://meta.discourse.org/t/iframe-attributes-not-working/127383/13). I think @falco is looking into it, so he may have some more info?

---

<div class="post-metadata">

### Author: ![boazcstrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/boazcstrike/32/262713_2.png) [@boazcstrike](https://meta.discourse.org/u/boazcstrike)
#### Post date: [June 30, 2022, 9:53am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545/3 "2022-06-30T09:53:26Z")

</div>

Hi Jammy!

We finally made it work.

There was a hidden setting called `allow_embedding_site_in_an_iframe` and we just set it to true inside the rails app:

```plaintext
SiteSetting.allow_embedding_site_in_an_iframe = true

```

Thank you! 😃

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 30, 2022, 9:55am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545/5 "2022-06-30T09:55:13Z")

</div>

Even better. 🙂 I’m glad you got it working. 👍

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [July 30, 2022, 9:55am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545/6 "2022-07-30T09:55:29Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.