app/controllers/embed_controller.rb 53ab3dda5 @setup_url = "#{Discourse.base_url}/admin/customize/embedding" @show_reason = true @hosts = EmbeddableHost.all end render 'embed_error', status: 400 end def topics discourse_expires_in 1.minute response.headers['X-Frame-Options'] = "ALLOWALL" unless SiteSetting.embed_topics_list? render 'embed_topics_error', status: 400 return end if @embed_id = params[:discourse_embed_id] raise Discourse::InvalidParameters.new(:embed_id) unless @embed_id =~ /^de\-[a-zA-Z0-9]+$/ end if params.has_key?(:template) && params[:template] == "complete" MDN doesn’t specify “ALLOWALL” as a possible value for the X-Frame-Options header. On Firefox, when loading any page with an embed, this can be seen in the console: [image] Any way to not send that header and specify the frame-ancestors directive for the Content-Security-Policy header? From the code it doesn’t seem there is a way to configure this.

I saw that error while working on the embed in our new blog. The easy thing to do is to just remove this header right?

I think so, yes. I am assuming you meant removing it from Discourse (vs. hiding it using some Nginx configuration). The header itself is considered obsolete now anyway. There are other occurrences of the same header in that file. Note: The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes this header for supporting browsers. [image] X-Frame-Options header - HTTP | MDN The HTTP X-Frame-Options response header can be used to indicate whether a browser should be allowed to render the document in a ,

This is fixed now: [image] Mitigate XSS Attacks with Content Security Policy Site Management We just landed support for CSP frame-ancestors directive. It’s disabled by default for now behind the content security policy frame ancestors site setting. You can add domains to the list using via /admin/customize/embedding as always. This directive will be enabled by default in the next release cycle.

And invalid response header is being set from embed controller

Product Support

Falco (Falco) March 23, 2021, 12:17am 4

This is fixed now:

Topic		Replies	Views
Browser prevents Discourse from rendering in iframe despite proper configuration (`X-Frame-Options: SAMEORIGIN`) Bug embedding	0	184	November 12, 2024
Embedded comments not displayed due to X-Frame-Options DENY Product Support	11	3555	July 18, 2016
Embedding error Product Support	13	4302	November 21, 2020
Refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin' Product Support	6	46328	November 11, 2018
CSP Frame Ancestors enabled by default Announcements	3	1816	August 5, 2021

And invalid response header is being set from embed controller

Related topics