app/controllers/embed_controller.rb 53ab3dda5 @setup_url = "#{Discourse.base_url}/admin/customize/embedding" @show_reason = true @hosts = EmbeddableHost.all end render 'embed_error', status: 400 e…

I saw that error while working on the embed in our new blog . The easy thing to do is to just remove this header right?

I think so, yes. I am assuming you meant removing it from Discourse (vs. hiding it using some Nginx configuration). The header itself is considered obsolete now anyway. There are other occurrences of the same header in that file. Note: The Content-Security-Policy HTTP header has a frame-ancestors …

This is fixed now: [画像] Mitigate XSS Attacks with Content Security Policy Site Management We just landed support for CSP frame-ancestors directive. It’s disabled by default for now behind the content security policy frame ancestors site setting. You can add do…

無効なレスポンスヘッダーがembed controllerから設定されています

サポート

Falco (Falco) 2021 年 3 月 23 日午前 12:17 4

これは現在修正されています：

トピック		返信	表示
Browser prevents Discourse from rendering in iframe despite proper configuration (`X-Frame-Options: SAMEORIGIN`) Bug embedding	0	130	2024 年 11 月 12 日
Embedded comments not displayed due to X-Frame-Options DENY Support	11	3397	2016 年 7 月 18 日
Embedding error Support	13	4082	2020 年 11 月 21 日
Refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin' Support	6	46206	2018 年 11 月 11 日
CSP Frame Ancestors enabled by default Announcements	3	1728	2021 年 8 月 5 日

無効なレスポンスヘッダーがembed controllerから設定されています

関連トピック