# First load on embedded comments fail on WebKit

**URL:** <https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206>\
**Category:** Bug\
**Created:** [Août 1, 2017, 12:16 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206 "2017-08-01T00:16:17Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)\
**Post date:** [Août 1, 2017, 12:16 UTC](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206/1 "2017-08-01T00:16:18Z")

</div>

The first time an article with embedded Discourse comments is loaded we load the IFRAME with the following request:

```plaintext
GET https://forum.example.com/embed/comments?embed_url=https://site.example.com/article
referer: https://site.example.com/article

```

This will serve a page with

```plaintext
  (function() {
    setTimeout(function() {
      document.location.reload();
    }, 30000);
  })();

```

So `Jobs::RetrieveTopic` have time to download the page, create the topic and work it’s magic.

30 seconds after the IFRAME reloads, and if we have a topic it works, and if we don’t it will try again in 30 seconds, just fine.

However, on Webkit and derivatives, thanks to [this bug](https://bugs.webkit.org/show_bug.cgi?id=104905) the Javascript reload will change the referer to the current location of the IFRAME:

```plaintext
GET https://forum.example.com/embed/comments?embed_url=https://site.example.com/article
referer: https://forum.example.com/embed/comments?embed_url=https://site.example.com/article

```

This will result in an error, because `forum.example.com` is not allowed to embed comments.

My proposal to work around this bug is to always allow the forum own FQDN in the list of allowed referrers. Is it a good fix?

---

_[View the full topic](https://meta.discourse.org/t/first-load-on-embedded-comments-fail-on-webkit/67206)._
