Users are discussing issues with embedding Discourse in an iframe, which is officially unsupported due to security and technical limitations. dreadkopp first reports a blank iframe when trying to embed Discourse running on port 82, noting that other non-80/443 sites display correctly. elberet explains that Discourse (via Rails) sets the X-Frame-Options: SAMEORIGIN header, blocking iframe embedding in modern browsers. Workarounds are shared: dubeydeepak suggests enabling CORS, though Julian_Somoza confirms this doesn’t change the X-Frame header. jack2 and Julian_Somoza provide plugin-based solutions to override the header. However, Julian_Somoza later reports a “You were logged out” modal appearing inside the iframe, resolved by disabling “SameSite cookies” in settings jack2, though merefield warns this may introduce cross-site vulnerabilities. codinghorror and osioke reiterate that iframe support is intentionally absent due to usability, security, and technical fragility—scrolling, navigation, and feature sandboxing break. For integration, osioke and Falco recommend styling Discourse to match the parent site or embedding topic lists via widgets instead of full iframes. AdamM seeks clarification on specific iframe issues and explores custom JS solutions to pull dynamic content into Discourse, which Falco confirms is possible with care. The consensus remains: iframe embedding is unsupported and discouraged, though technically possible with significant risk and effort.
i first thought that it might be a problem with iframe to shown pages which don’t use port 80 or 443 but since another test shows that my plone-environment at port 81 (http://archy.no-ip.org/iframe-test-different-port/) is shown correctly that cannot be it.
Discourse (actually Rails) sends a X-Frame-Options header that tells browsers that the site does not wish to be embedded in an iframe, hence all modern browsers will simply render a white square. You can see this in e.g. Chrome’s dev console which says
Refused to display 'http://archy.no-ip.org:82/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.
The only way to “fix” this is to hack Discourse yourself: move the EmbedController’s before_filter and ensure_embeddable method into the main ApplicationController and set the embeddable host site setting. But, while it can be done, you’ll be on extremely unsupported terrain…
I’m able to load Discourse in an iframe … on Firefox. But not Chrome (or Safari). In Chrome I have the following problem: Nothing is clickable! If I open the inspector and drill into the source it will highlight various elements (e.g. rows), but neither right clicks nor left clicks on any content of iframe have an effect. Any suggestions?
A solution to run Discourse in an iframe is to create a plugin that contains the following code in plugin.rb:
# Changes X-Frame-Options so the site can be embedded in an iframe. See:
# https://github.com/BeXcellent/discourse-allowiframe/blob/master/plugin.rb
# https://github.com/TheBunyip/discourse-allow-same-origin/blob/master/plugin.rb
Rails.application.config.action_dispatch.default_headers.merge!({'X-Frame-Options' => 'ALLOWALL'})
@Julian_Somoza, the Discourse team promotes an opinionated way of using Discourse and will not support alternatives. Additionally, they always reminds people of that fact.
That being said, I’m not from the Discourse team, so I can discuss your issue I use Discourse in an iframe for my project and never got the “You were logged out” modal.
I use Discourse in an iframe for my project and never got the “You were logged out” modal.