# Iframe allow attribute not working

**URL:** https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383
**Category:** Feature
**Created:** [September 2, 2019, 9:10am UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383 "2019-09-02T09:10:31Z")
**Posts on this page:** 15
**Page:** 1

<div class="post-metadata">

### Author: ![santosguillamot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/santosguillamot/32/143077_2.png) [@santosguillamot](https://meta.discourse.org/u/santosguillamot)
#### Post date: [September 2, 2019, 9:10am UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/1 "2019-09-02T09:10:31Z")

</div>

I have added a codesandbox iframe with different attributes but Discourse is just getting the `src`. Should I change something in Discourse Settings? I have already allowed this iframe and it is showing, but not correctly.

This is the iframe I am trying to add:

```html
<iframe 
  src="https://codesandbox.io/embed/codesandbox-frontity-rnclp?fontsize=14" 
  title="Frontity - Post with recompose" 
  allow="geolocation; microphone; camera; midi; vr; accelerometer; gyroscope; payment; ambient-light-sensor; encrypted-media; usb" 
  style="width:100%; height:500px; border:0; border-radius: 4px; overflow:hidden;" 
  sandbox="allow-modals allow-forms allow-popups allow-scripts allow-same-origin"
></iframe>

```

But it is just rendering this:

![Need_to_integrate_react-stripe-elements_-%F0%9F%A4%97_Dev_Talk___Questions-_Frontity_Community_Forum](https://global.discourse-cdn.com/meta/original/3X/4/8/482b2c99cd7d23951331362756e0de28fe1ca2e5.png)

So the iframe is not showing correctly:

 ![09](https://global.discourse-cdn.com/meta/original/3X/c/6/c607af03acaf559ab9250dd39d6671ef7a9c6380.png)

---

<div class="post-metadata">

### Author: ![dax](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dax/32/244677_2.png) [@dax](https://meta.discourse.org/u/dax)
#### Post date: [September 2, 2019, 2:44pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/2 "2019-09-02T14:44:20Z")

</div>

It works for me

![image](https://global.discourse-cdn.com/meta/original/3X/6/5/65bfd7e77bee21a24ec04c987f322de09c3185c8.png)

Just to be sure, did you add the iframe url (`https://codesandbox.io/embed/codesandbox-frontity-rnclp`) in whitelist? If not, search the site setting `allowed iframes`.

---

<div class="post-metadata">

### Author: ![santosguillamot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/santosguillamot/32/143077_2.png) [@santosguillamot](https://meta.discourse.org/u/santosguillamot)
#### Post date: [September 2, 2019, 2:56pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/3 "2019-09-02T14:56:16Z")

</div>

I have this domain: `https://codesandbox.io/`. Shouldn’t be enough? I have found this code at Discourse where it whitelists just some iframe attributes:

> <https://github.com/discourse/discourse/blob/06d974d55cb44fb3577a98a2d89d93542200fe52/app/assets/javascripts/pretty-text/white-lister.js.es6#L164-L169>

If I include the attributes `height` and `weight` the iframe works fine, but I would like to allow the other attributes too.

Is there a way of allowing all codesandbox iframes? I thought including just the domain it would work.

Thank you!

EDIT:

> [@dax](#):
>
> Just to be sure, did you add the iframe url ( `https://codesandbox.io/embed/codesandbox-frontity-rnclp` ) in whitelist? If not, search the site setting `allowed iframes` .

I have tried adding this url in whitelist but it is not working neither.

---

<div class="post-metadata">

### Author: ![downey](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/downey/32/166878_2.png) [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 4, 2021, 9:15pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/4 "2021-03-04T21:15:53Z")

</div>

I am also running into this problem. I would like to add a class on the IFRAME that I am embedding in my policy privacy post, which embeds the privacy tracking settings from our self-hosted Matomo installation. This would allow me to add a better border and some color to differentiate it from the rest of the privacy policy.

Despite having a `class="foo"` in my IFRAME element, it is being stripped out, apparently by the white-lister code above. Any chance this could be expanded to have a few more attributes allowed?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 4, 2021, 9:24pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/5 "2021-03-04T21:24:17Z")

</div>

For security we are **very** strict of what HTML attributes can be rendered in our page when they come from user input.

What you can do to get that is:

```HTML
<div data-my-special-attr="42">
  <iframe src="http://example.com">
</div>

```

and then target _that_ with your CSS / JS selector:

```css
div[data-my-special-attr="42"] > iframe {
  border-color: pink;
}

```

---

<div class="post-metadata">

### Author: ![downey](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/downey/32/166878_2.png) [@downey](https://meta.discourse.org/u/downey)
#### Post date: [March 5, 2021, 5:17pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/6 "2021-03-05T17:17:09Z")

</div>

> [@Falco](#):
>
> What you can to get that is…

Thanks! That worked on both the topic page and the rendered privacy policy special page as well.

Of note if anyone else is trying this, you can’t add a `class` attribute, you literally need to add an attribute along the lines of `data-foo-attr`.

---

<div class="post-metadata">

### Author: ![selfscrum](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/selfscrum/32/215160_2.png) [@selfscrum](https://meta.discourse.org/u/selfscrum)
#### Post date: [March 30, 2021, 8:39pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/7 "2021-03-30T20:39:46Z")

</div>

Rafael thanks for the statement, it clarifies my observed behaviour.  
I would like to know whether you have any plans of releasing that lock for audio/video attributes of an iframe. Modern browsers manage accessibility quite good for those allowances, and there are increasingly interesting service offerings which would be great to integrate by users but just lack this type of accessibility.  
Thanks.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [March 30, 2021, 8:43pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/8 "2021-03-30T20:43:35Z")

</div>

We are always open to feedback!

It gets easier if we talk about specifics, like what are the exact attributes you want allowlisted and for what services they are necessary.

---

<div class="post-metadata">

### Author: ![selfscrum](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/selfscrum/32/215160_2.png) [@selfscrum](https://meta.discourse.org/u/selfscrum)
#### Post date: [March 30, 2021, 8:45pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/9 "2021-03-30T20:45:56Z")

</div>

ok. I especially think about [Jam Systems / Jam · GitLab](https://gitlab.com/jam-systems/jam) which would need an allow=“microphone \*;” parameter to work properly.

---

<div class="post-metadata">

### Author: ![cogdog](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cogdog/32/116536_2.png) [@cogdog](https://meta.discourse.org/u/cogdog)
#### Post date: [November 4, 2021, 6:57pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/10 "2021-11-04T18:57:02Z")

</div>

I am running into same issue [attempting to embed an H5P audio recorder](https://meta.discourse.org/t/an-iframe-in-a-post-reports-not-https/208122); the allow=“microphone \*;” option is stripped from the iframe.

What would take to perhaps have an iframe setting to allow allows?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [November 14, 2021, 6:16am UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/11 "2021-11-14T06:16:19Z")

</div>

Can we allow admins to specify which `iframe` attributes they want allowlisted?

---

<div class="post-metadata">

### Author: ![gilby](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gilby/32/265262_2.png) [@gilby](https://meta.discourse.org/u/gilby)
#### Post date: [June 28, 2022, 10:30pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/13 "2022-06-28T22:30:47Z")

</div>

This would be useful, but we’d also be happy with the `allow` attribute being whitelisted for all. We’re currently running into audio playback issues with embedded Apple and Spotify podcast players. As others have mentioned, the issue is that the `allow` attribute is being stripped, which contains an important `encrypted-media` directive.

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [June 30, 2022, 7:48pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/15 "2022-06-30T19:48:15Z")

</div>

> [@codinghorror](#):
>
> Can we allow admins to specify which `iframe` attributes they want allowlisted?

Since we are already strict about which domains can be used in iframes, having yet another setting where we set the `allow` string for each iframe and parsing the weird `allow` content format seems a bit much for me.

I made a PR that simply allows using anything in the allow attribute for already allowed iframes:

[https://github.com/discourse/discourse/pull/17291](https://github.com/discourse/discourse/pull/17291)

What do you think @sam ?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 4, 2022, 7:21am UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/16 "2022-07-04T07:21:04Z")

</div>

> [@Falco](#):
>
> What do you think @sam ?

Hmm, I guess I am OK with this, I see your logic here, @david any objections?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [July 5, 2022, 6:52pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/17 "2022-07-05T18:52:40Z")

</div>

This changed was merged @santosguillamot @selfscrum @cogdog @gilby