# Iframe allow attribute not working

**URL:** <https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383>\
**Category:** Feature\
**Created:** [September 2, 2019, 9:10am UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383 "2019-09-02T09:10:31Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)\
**Post date:** [June 30, 2022, 7:48pm UTC](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383/15 "2022-06-30T19:48:15Z")

</div>

> [@codinghorror](#):
>
> Can we allow admins to specify which `iframe` attributes they want allowlisted?

Since we are already strict about which domains can be used in iframes, having yet another setting where we set the `allow` string for each iframe and parsing the weird `allow` content format seems a bit much for me.

I made a PR that simply allows using anything in the allow attribute for already allowed iframes:

[https://github.com/discourse/discourse/pull/17291](https://github.com/discourse/discourse/pull/17291)

What do you think @sam ?

---

_[View the full topic](https://meta.discourse.org/t/iframe-allow-attribute-not-working/127383)._