# Allowed iframes whitelist not working - 'x-frame-options: SAMEORIGIN'

**URL:** <https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545>\
**Category:** Product Support\
**Created:** [June 30, 2022, 9:24am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545 "2022-06-30T09:24:06Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![boazcstrike](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/boazcstrike/32/262713_2.png) [@boazcstrike](https://meta.discourse.org/u/boazcstrike)\
**Post date:** [June 30, 2022, 9:24am UTC](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545/1 "2022-06-30T09:24:06Z")

</div>

The allowed iframes whitelist is not working for us. We’ve added a github plugin with `plugin.rb`:

```plaintext
Rails.application.config.action_dispatch.default_headers.merge!({'X-Frame-Options' => 'ALLOWALL'})
Rails.application.config.action_dispatch.default_headers.merge!({'Access-Control-Allow-Origin' => '*'})
Rails.application.config.action_dispatch.default_headers.merge!({'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS, DELETE'})
Rails.application.config.action_dispatch.default_headers.merge!({'Access-Control-Allow-Headers' => 'Content-Type, Authorization, X-Requested-With'})

```

but for some reason, discourse keeps reverting it back to  
`x-frame-options: SAMEORIGIN`  
 ![image](https://global.discourse-cdn.com/meta/original/4X/9/6/0/96000ee84c62420a94623848fdf044c62bf9c862.png)

Everything works in http localhost but when deployed in https, nothing is working.

---

_[View the full topic](https://meta.discourse.org/t/allowed-iframes-whitelist-not-working-x-frame-options-sameorigin/231545)._