Help with Embed: Unable to post message to [discourse]. Receipient has origin [mydomain]

Product Support

AI-generated summary

The discussion revolves around an issue with embedding comments on a site using Discourse. benscheirman reports encountering an error in Safari when trying to post a message to the embedded Discourse page, with the console showing “Unable to post message to https://forum.nsscreencast.com. Recipient has origin https://nsscreencast.com.”

Falco acknowledges the issue, stating it’s due to recent browser changes and that a fix is forthcoming. In the meantime, Falco asks benscheirman to share the embedding settings. After benscheirman shares the settings, Falco explains that the long load time for the first post and occasional failure to refresh is a known bug, caused by how browsers handle an iframe refresh using a <meta> tag. A proposed fix is available, and Falco shares the PR link (https://github.com/discourse/discourse/pull/13756) for benscheirman to track.

1

I have a new Discourse set up and am trying to embed comments on a page on another site.

When I run this in Safari I get this error in the JavaScript console:

Unrecognized Content-Security-Policy directive 'worker-src'.

The embed page shows “Loading discussion…” for about 30 seconds.

Then I see this in the console:

Unrecognized Content-Security-Policy directive 'worker-src'.
Unrecognized Content-Security-Policy directive 'worker-src'.
Unable to post message to https://forum.nsscreencast.com. Recipient has origin https://nsscreencast.com.

I presume this is to have the iframe self-size after content is loaded. When I run this in a Chromium-based browser I don’t get this error.

Is there something I need to configure to get this postMessage flow working in Safari?

2

This is something we are going to fix soon. We rely on the referer for embed requests to check if they are allowed, but recent changes to browsers broke a lot of our assumptions in this area.

3

:+1: Thanks for the quick reply. Anything I can do in the meantime to get around this? i.e. implementing some custom JS on the embedding site?

4

What are the settings at /admin/customize/embedding ?

5

Seems pretty basic…

It is working, however the first post seems to load a long time and often doesn’t refresh on its own. After that I can see “Start Discussion” or the actual replies.

image
image1746×212 16 KB

Settings:

Username: benscheirman
Max posts to embed: 100
Regular expression to stripe title: “- NSScreencast$”

Truncate: YES
Imported topics will be unlisted until there is a reply: NO

6

That is the exact bug we have, and it happens due to a quirky on the browsers about how they handle a refresh in an iFrame using the a tag in the head, which we had to introduce in Extract inline JS on embedded comments by xrav3nz · Pull Request #6645 · discourse/discourse · GitHub to enable CSP.

So the first person to visit a blog post with comments will have to refresh it to see the embed, all subsequent visits will work. We have a proposed fix already and will merge it in a few weeks.

7

I wanted to follow up on this and see if this fix was merged. If not, can you link the PR here so I can track it?

8

https://github.com/discourse/discourse/pull/13756