# Discourse integration for Microsoft Teams?

**URL:** https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577
**Category:** Feature
**Created:** [8 november 2018 om 00:13 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577 "2018-11-08T00:13:19Z")
**Posts on this page:** 1
**Showing post:** 9

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [26 november 2018 om 00:02 UTC](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577/9 "2018-11-26T00:02:18Z")

</div>

Just to clarify what is happening here, we ship a header with Discourse called:

```plaintext
X-Frame-Options: SAMEORIGIN

```

This stops sites adding yours site as an `IFRAME` which is a filthy SEO trick some people do to steal page rank and causes overall levels of confusion and do nasty things like clickjacking:

> **[Clickjacking](https://en.wikipedia.org/wiki/Clickjacking)**
>
> Clickjacking (classified as a user interface redress attack or UI redressing) is a malicious technique of tricking a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects, including web pages.
> Clickjacking is an instance of the confused deputy problem, wherein a computer is tricked into misusing its authority.
> In 2002, it had ...

What I strongly support adding to Discourse is some ability to customize this header:

> **[X-Frame-Options header - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options)**
>
> The HTTP X-Frame-Options response header can be used to indicate whether a browser should be allowed to render the document in a ,

In particular we could allow you to define:

```plaintext
X-Frame-Options: allow-from https://my-team-site.team.microsoft.com

```

This particular request does not come up too often, but I do support amending it. It is a bit of a tricky change cause we do need some defense in depth here, some of our assets are delivered not via the app and we can not swap in the magic value there.

---

_[View the full topic](https://meta.discourse.org/t/discourse-integration-for-microsoft-teams/101577)._
