# First load on embedded comments fail on WebKit

**URL:** <https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206>\
**Category:** Bug\
**Created:** [2017年八月1日 00:16 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206 "2017-08-01T00:16:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)\
**Post date:** [2017年八月1日 00:16 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206/1 "2017-08-01T00:16:18Z")

</div>

The first time an article with embedded Discourse comments is loaded we load the IFRAME with the following request:

```plaintext
GET https://forum.example.com/embed/comments?embed_url=https://site.example.com/article
referer: https://site.example.com/article

```

This will serve a page with

```plaintext
  (function() {
    setTimeout(function() {
      document.location.reload();
    }, 30000);
  })();

```

So `Jobs::RetrieveTopic` have time to download the page, create the topic and work it’s magic.

30 seconds after the IFRAME reloads, and if we have a topic it works, and if we don’t it will try again in 30 seconds, just fine.

However, on Webkit and derivatives, thanks to [this bug](https://bugs.webkit.org/show_bug.cgi?id=104905) the Javascript reload will change the referer to the current location of the IFRAME:

```plaintext
GET https://forum.example.com/embed/comments?embed_url=https://site.example.com/article
referer: https://forum.example.com/embed/comments?embed_url=https://site.example.com/article

```

This will result in an error, because `forum.example.com` is not allowed to embed comments.

My proposal to work around this bug is to always allow the forum own FQDN in the list of allowed referrers. Is it a good fix?

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [2017年八月1日 01:19 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206/2 "2017-08-01T01:19:03Z")

</div>

That seems plenty safe to me…

---

<div class="post-metadata">

**Author:** ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)\
**Post date:** [2017年八月8日 15:25 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206/3 "2017-08-08T15:25:36Z")

</div>

Fixed in

[https://github.com/discourse/discourse/pull/5018](https://github.com/discourse/discourse/pull/5018)

---

<div class="post-metadata">

**Author:** ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)\
**Post date:** [2017年八月8日 15:25 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206/4 "2017-08-08T15:25:40Z")

</div>