# CORS Error when embedding comments in Gitlab-hosted Jekyll static site
**URL:** https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194
**Category:** Support
**Created:** [October 16, 2017, 4:48pm UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194 "2017-10-16T16:48:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@chrishiero](https://meta.discourse.org/u/chrishiero)
#### Post date: [October 16, 2017, 4:48pm UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194/1 "2017-10-16T16:48:34Z")
New Discourse user here just trying to get a basic site skeleton up. So far, almost everything has been smooth except for getting the comment-embedding/post-generating functionality to work.
I have my Discourse instance running on a Digital Ocean droplet, as per the setup instructions.
My discourse url is: `http://discuss.singlebagtravel.com`
My static site is located at: `http://singlebagtravel.com`
I have added: `DISCOURSE_ENABLE_CORS: true` to the `app.yml` file and re-launched.
I have set Settings \> Security \> cors origins to: `http://singlebagtravel.com`
The console on my static site where I embed the comments shows this:
> Failed to execute ‘postMessage’ on ‘DOMWindow’: The target origin provided (‘[http://discuss.singlebagtravel.com](http://discuss.singlebagtravel.com)’) does not match the recipient window’s origin (‘[http://singlebagtravel.com](http://singlebagtravel.com)’)
There are a number of similar posts that I found in the forums that have helped me get this far, but none of the solutions suggested in any of them have worked for me. I feel like I may be missing something obvious here, because it seems like it _should_ work.
Thanks!
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 16, 2017, 10:38pm UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194/2 "2017-10-16T22:38:00Z")
Looks like you need to add both domain and sub domain in your cors settings then?
---
### Author:  [@chrishiero](https://meta.discourse.org/u/chrishiero)
#### Post date: [October 16, 2017, 11:05pm UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194/3 "2017-10-16T23:05:35Z")
@codinghorror Seems like that should have solved it, but the error is the same even with `http://discuss.singlebagtravel.com` added to cors origins.
---
### Author:  [@chrishiero](https://meta.discourse.org/u/chrishiero)
#### Post date: [October 17, 2017, 12:08am UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194/4 "2017-10-17T00:08:22Z")
Turns out it was a ridiculously simple mistake - apparently there is a “Save Embedding Settings” button at the very far bottom left of the screen on the settings. Even though it _looks like_ clicking the blue check mark next to the host does the “save”, you still need to find that save button and click it.
Additionally, once I did find it I was alerted to the fact that I needed to enter a username.
Honestly, that save button is really unintuitive - it is difficult to find, there is no penalty for not hitting it, the page seems to save my settings regardless (but not apply them I guess?) and none of the guides on this mention that I need to find it and hit it.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [November 22, 2019, 12:50pm UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194/5 "2019-11-22T12:50:47Z")
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 24, 2019, 11:24pm UTC](https://meta.discourse.org/t/cors-error-when-embedding-comments-in-gitlab-hosted-jekyll-static-site/72194/6 "2019-11-24T23:24:33Z")