# CORS question embedding Blogspot

**URL:** https://meta.discourse.org/t/cors-question-embedding-blogspot/242236
**Category:** Support
**Created:** [October 18, 2022, 5:28pm UTC](https://meta.discourse.org/t/cors-question-embedding-blogspot/242236 "2022-10-18T17:28:59Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![DonH](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/donh/32/274040_2.png) [@DonH](https://meta.discourse.org/u/DonH)
#### Post date: [October 18, 2022, 5:29pm UTC](https://meta.discourse.org/t/cors-question-embedding-blogspot/242236/1 "2022-10-18T17:29:00Z")

</div>

Having see our newly embedded (same-domain) Ghost blog one of our members asked if it was possible to do the same with his at Blogspot. I’ve tried but can only get this far:

 ![Screenshot (88)](https://global.discourse-cdn.com/meta/original/4X/e/f/d/efd2db65e548153338e33594ee76535e8cd8b406.png)

Allowed hosts are:

 ![Screenshot (89)](https://global.discourse-cdn.com/meta/original/4X/6/6/4/664a0f4ba8fcd194e4afb9d81005037efc917d15.png)

The embedded script is:

```plaintext
<script type="text/javascript">
DiscourseEmbed = { discourseUrl: 'https://forum.rosehybridizers.org/',
			     discourseEmbedUrl: '{{url absolute="true"}}' };
(with and without discourseReferrerPolicy: 'strict-origin-when-cross-origin'};)

(function() {
var d = document.createElement('script'); d.type = 'text/javascript'; d.async = true;
d.src = DiscourseEmbed.discourseUrl + 'javascripts/embed.js';
(document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(d);
</script>  

```

CORS is enabled through App.yml:

DISCOURSE\_ENABLE\_CORS: true

I also tried it with

DISCOURSE\_CORS\_ORIGIN: ‘\*’

followed by app destroy/ start each time.

The allowed origin is:

 ![Screenshot (90)](https://global.discourse-cdn.com/meta/original/4X/0/3/8/038465fe45305f2b90842afbf3edb21dde47186d.png)

These settings are both checked:

Enable Content-Security-Policy  
and  
Restrict who can embed this site in iframes via CSP.

Jscript console says

 ![Screenshot (91)](https://global.discourse-cdn.com/meta/original/4X/6/e/6/6e63f802eb01706fd14c92445a9fad86b03e593f.jpeg)

Any help would be greatly appreciated.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [October 19, 2022, 12:17am UTC](https://meta.discourse.org/t/cors-question-embedding-blogspot/242236/2 "2022-10-19T00:17:54Z")

</div>

> [@DonH](#):
>
> `discourseEmbedUrl: '{{url absolute="true"}}' };`

This is wrong, as the `{{url absolute="true"}}` is not replaced before the code is executed.

Also, you may want to limit the code loading the Discourse comments to only article pages and not the homepage.