app/controllers/embed_controller.rb 53ab3dda5 @setup_url = "#{Discourse.base_url}/admin/customize/embedding" @show_reason = true @hosts = EmbeddableHost.all end render 'embed_error', status: 400 e…

I saw that error while working on the embed in our new blog . The easy thing to do is to just remove this header right?

I think so, yes. I am assuming you meant removing it from Discourse (vs. hiding it using some Nginx configuration). The header itself is considered obsolete now anyway. There are other occurrences of the same header in that file. Note: The Content-Security-Policy HTTP header has a frame-ancestors …

This is fixed now: [изображение] Mitigate XSS Attacks with Content Security Policy Site Management We just landed support for CSP frame-ancestors directive. It’s disabled by default for now behind the content security policy frame ancestors site setting. You c…

Неверный заголовок ответа устанавливается контроллером embed

Поддержка

Falco (Falco) 23.Март.2021 00:17:03 4

Это исправлено сейчас:

Тема		Ответов	Просм.
Browser prevents Discourse from rendering in iframe despite proper configuration (`X-Frame-Options: SAMEORIGIN`) Bug embedding	0	130	12.11.2024
Embedded comments not displayed due to X-Frame-Options DENY Support	11	3396	18.07.2016
Embedding error Support	13	4071	21.11.2020
Refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin' Support	6	46204	11.11.2018
CSP Frame Ancestors enabled by default Announcements	3	1728	05.08.2021

Неверный заголовок ответа устанавливается контроллером embed

Связанные темы