# Embedded comments not displayed due to X-Frame-Options DENY
**URL:** https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365
**Category:** Support
**Created:** [2016 年 7 月 15 日午後 4:51 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365 "2016-07-15T16:51:33Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 15 日午後 4:51 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/1 "2016-07-15T16:51:33Z")
Hello,
I setup comments on my blog using this guide: [Embed Discourse comments on another website via Javascript](https://meta.discourse.org/t/embedding-discourse-comments-via-javascript/31963)
It worked at some point, but now the comments are not displayed. In the firefox console, I see:
```plaintext
Load denied by X-Frame-Options: https://... does not permit framing.
```
And in the network section, for this resource, I see that:
```plaintext
X-Frame-Options: "ALLOWALL, DENY"
```
I have no idea what’s going on, but I think it may be related to SSL.
Both the blog and the discourse instance are behind a reverse proxy which does the actual SSL.
The blog is here: [https://avril4th.com](https://avril4th.com)
and the discourse instance: [https://discourse.avril4th.com](https://discourse.avril4th.com)
I’m not sure what other information could be relevant.
Cheers,
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2016 年 7 月 15 日午後 11:24 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/2 "2016-07-15T23:24:02Z")
Is “force https” set in your Discourse settings?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [2016 年 7 月 16 日午前 6:06 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/3 "2016-07-16T06:06:45Z")
> [@guiniol](#):
>
> X-Frame-Options: “ALLOWALL, DENY”
That is… extremely weird. I don’t think there’s any point in an `ALLOWALL, DENY` record as “ALLOWALL” doesn’t actually mean anything to the browser, just analysis tools (checking if the X-FO is missing, i.e. you didn’t think about it).
I’m guessing the proxy is adding `, DENY` to the end?
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 16 日午前 7:20 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/4 "2016-07-16T07:20:13Z")
> [@codinghorror](#):
>
> Is “force https” set in your Discourse settings?
No. Since discourse talks http with the reverse proxy and the reverse proxy does the ssl, I wasn’t sure this wouldn’t break my setup.
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 16 日午前 7:22 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/5 "2016-07-16T07:22:42Z")
> [@riking](#):
>
> I’m guessing the proxy is adding `, DENY` to the end?
I don’t think so. I’m using nginx, and I added `X-Forwarded-For`, `X-Real-IP` and `X-Forwarded-Proto`, but that’s only on the way to discourse I think.
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [2016 年 7 月 16 日午前 8:06 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/6 "2016-07-16T08:06:06Z")
I’m running such a setup with that option checked, so it should be working fine 🙂
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 16 日午前 8:09 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/7 "2016-07-16T08:09:12Z")
> [@fefrei](#):
>
> I’m running such a setup with that option checked, so it should be working fine 🙂
Alright. Tried it. Discourse still works, but it didn’t change anything to the embedding.
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 17 日午後 5:35 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/8 "2016-07-17T17:35:14Z")
Just to make sure, I added `add_header X-Frame-Options "ALLOWALL";` to the nginx configuration. The comments are displayed properly in this case. So the question is what is adding `DENY` at the end, and why?
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 17 日午後 6:32 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/9 "2016-07-17T18:32:57Z")
So… it seems it was nginx adding the `DENY` at the end. Not sure why exactly, but I think it may have to do with `proxy_set_header X-Forwarded-Proto $scheme;`. When I added `add_header X-Frame-Options "ALLOWALL"`, I ended up with two `ALLOWALL` so I set it to `add_header X-Frame-Options ""` and now I only have one (like I should).
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 17 日午後 6:35 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/10 "2016-07-17T18:35:19Z")
For anyone else having the same problem, this is what I added inside the `location` for discourse:
```plaintext
if ($args ~ "embed_url=https%3A%2F%2Favril4th.com%2F") {
add_header X-Frame-Options "";
}
```
Not an nginx expert, so maybe there are better ways to do it.
EDIT: talked to experts in #nginx. See solution below
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 17 日午後 8:57 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/11 "2016-07-17T20:57:59Z")
> [@guiniol](#):
>
> So… it seems it was nginx adding the DENY at the end. Not sure why exactly, but I think it may have to do with proxy\_set\_header X-Forwarded-Proto $scheme;. When I added add\_header X-Frame-Options “ALLOWALL”, I ended up with two ALLOWALL so I set it to add\_header X-Frame-Options “” and now I only have one (like I should).
Well, it was me all along. When I added ssl, I also added a few lines for security, one of which was the `X-Frame-Options DENY`. Mistery solved on that front.
---
### Author:  [@guiniol](https://meta.discourse.org/u/guiniol)
#### Post date: [2016 年 7 月 18 日午後 9:27 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/12 "2016-07-18T21:27:15Z")
In case someone stumbles upon this thread and wants `X-Frame-Options DENY` as defaults but still wants to embed comments, here is the solution direct from #nginx (apparently `if`s should be avoided where possible:
outside of the `server` clause:
```plaintext
map $arg_embed_url $xfo {
default DENY;
~^https%3A%2F%2Favril4th.com%2F.* "ALLOW-FROM https://avril4th.com/";
}
```
and then inside the `location` where you want to allow embeding:
```plaintext
add_header X-Frame-Options $xfo;
```
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [2024 年 6 月 8 日午後 12:45 UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/13 "2024-06-08T12:45:23Z")
このトピックは2884日後に自動的に閉じられました。返信はもう許可されていません。