app/controllers/embed_controller.rb 53ab3dda5 @setup_url = "#{Discourse.base_url}/admin/customize/embedding" @show_reason = true @hosts = EmbeddableHost.all end render 'embed_error', status: 400 end def topics discourse_expires_in 1.minute response.headers['X-Frame-Options'] = "ALLOWALL" unless SiteSetting.embed_topics_list? render 'embed_topics_error', status: 400 return end if @embed_id = params[:discourse_embed_id] raise Discourse::InvalidParameters.new(:embed_id) unless @embed_id =~ /^de\-[a-zA-Z0-9]+$/ end if params.has_key?(:template) && params[:template] == "complete" MDN doesn’t specify “ALLOWALL” as a possible value for the X-Frame-Options header. On Firefox, when loading any page with an embed, this can be seen in the console: [image] Any way to not send that header and specify the frame-ancestors directive for the Content-Security-Policy header? From the code it doesn’t seem there is a way to configure this.

I saw that error while working on the embed in our new blog. The easy thing to do is to just remove this header right?

I think so, yes. I am assuming you meant removing it from Discourse (vs. hiding it using some Nginx configuration). The header itself is considered obsolete now anyway. There are other occurrences of the same header in that file. Note: The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes this header for supporting browsers. [תמונה] X-Frame-Options header - HTTP | MDN The HTTP X-Frame-Options response header can be used to indicate whether a browser should be allowed to render the document in a ,

This is fixed now: [תמונה] Mitigate XSS Attacks with Content Security Policy Site Management We just landed support for CSP frame-ancestors directive. It’s disabled by default for now behind the content security policy frame ancestors site setting. You can add domains to the list using via /admin/customize/embedding as always. This directive will be enabled by default in the next release cycle.

וכותרת תגובה לא תקינה מוגדרת מ-embed controller

תמיכה

Falco (Falco) 23 במרץ,‏ 2021,‏ 12:17am 4

This is fixed now:

נושא		תגובות	צפיות
Browser prevents Discourse from rendering in iframe despite proper configuration (`X-Frame-Options: SAMEORIGIN`) Bug embedding	0	185	12 בנובמבר,‏ 2024
Embedded comments not displayed due to X-Frame-Options DENY Product Support	11	3569	18 ביולי,‏ 2016
Embedding error Product Support	13	4328	21 בנובמבר,‏ 2020
Refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin' Product Support	6	46334	11 בנובמבר,‏ 2018
CSP Frame Ancestors enabled by default Announcements	3	1821	5 באוגוסט,‏ 2021

וכותרת תגובה לא תקינה מוגדרת מ-embed controller

נושאים קשורים