### Author:  [@kvz](https://meta.discourse.org/u/kvz)
#### Post date: [8월 16, 2017, 6:27오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/1 "2017-08-16T18:27:05Z")
Hi, hope I’m asking at the right place! We want to use a hosted (as in paid) discourse account and embed it on three sites to power their comment sections.
It is my understanding that I would need to whitelist 3 domains as cors origins which I’ve done like so: [https://dl.dropboxusercontent.com/s/4zrqarqjln7qj8k/2017-08-16%20at%2020.16.png](https://dl.dropboxusercontent.com/s/4zrqarqjln7qj8k/2017-08-16%20at%2020.16.png)
It seems however upon some testing that only the first domain is returned: [https://dl.dropboxusercontent.com/s/jctq7uejd8lbqbj/2017-08-16%20at%2020.22.png](https://dl.dropboxusercontent.com/s/jctq7uejd8lbqbj/2017-08-16%20at%2020.22.png)
It is my understanding that it’s not possible to return multiple origins in the cors header. In our company we’ve worked around that by checking the `origin`, and matching it against a short whitelist. If it occurs, we return that specific origin for the current request. That way multiple origins can indeed be supported.
Could this be something you’d be willing to support/implement or should we go for a self-hosted solution and hack around this? For one thing, I think the way the interface is now, you would expect it allows multiple origins.
Would be awesome if you’d consider this, as I’m looking forward very much to building a community for our open source projects with discourse! \<3
---
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [8월 16, 2017, 8:18오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/2 "2017-08-16T20:18:58Z")
If the origin of the request matches one of the listed origins, then we return that as the allowed CORS origin.
>
So it should already be working for you.
---
### Author:  [@kvz](https://meta.discourse.org/u/kvz)
#### Post date: [8월 17, 2017, 2:47오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/3 "2017-08-17T14:47:52Z")
Okay then it must be something fishy on my end. I’ll dive deeper, thanks a lot for verifying this for me!
---
### Author:  [@kvz](https://meta.discourse.org/u/kvz)
#### Post date: [8월 17, 2017, 3:09오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/4 "2017-08-17T15:09:05Z")
So, as far as I can tell, all requests are coming through correctly. Here are the ones from [discourse.org](http://discourse.org):
And these are from our [https://community.transloadit.com](https://community.transloadit.com) server:
There are no errors in the console (that relate to discourse, or would stop javascript execution):
Yet I keep seeing that “Error Embedding” message when testing locally. From the server side, I have configured these four allowed embedding hosts:
.. as well as enabled these CORS origins:
which according to [these instructions](https://meta.discourse.org/t/embedding-discourse-comments-via-javascript/31963) are the common things that go wrong.
I’m sure I’m doing something silly but since there’s no error I’m unsure how to debug this further. Would you have clues?
---
### Author:  [@kvz](https://meta.discourse.org/u/kvz)
#### Post date: [8월 17, 2017, 6:57오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/5 "2017-08-17T18:57:52Z")
Just deployed it to production so you can have a look: [Releasing our official Python SDK | Transloadit](https://transloadit.com/blog/2017/08/python-sdk-release/)
Getting these errors:
`Refused to display 'https://community.transloadit.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.`
(which I believe is set on your end and should really allow us to iframe, correct?)
and:
```plaintext
VM2928 comments?embed_url=https%3A%2F%2Ftransloadit.com%2Fblog%2F2017%2F08%2Fpython-sdk-release%2F:17 Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://community.transloadit.com') does not match the recipient window's origin ('https://transloadit.com').
postUp @ VM2928 comments?embed_url=https%3A%2F%2Ftransloadit.com%2Fblog%2F2017%2F08%2Fpython-sdk-release%2F:17
window.onload @ VM2928 comments?embed_url=https%3A%2F%2Ftransloadit.com%2Fblog%2F2017%2F08%2Fpython-sdk-release%2F:38
```
Which just confuses me a great deal 🙂
You _can_ see topics are being created now: [https://community.transloadit.com/t/major-improvements-to-our-go-sdk/276](https://community.transloadit.com/t/major-improvements-to-our-go-sdk/276)
But the iframing does not work. Could this be because we enabled HTTPS and your HTTPS terminator sets some additional security enhancing headers that are not compatible with embedding?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [8월 17, 2017, 10:36오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/7 "2017-08-17T22:36:31Z")
Hi, just wanted to let you know we’re taking a look at this.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [8월 18, 2017, 8:15오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/11 "2017-08-18T20:15:42Z")
@sam thinks we have fixed this, and have deployed, can you try again and let us know?
---
### Author:  [@kvz](https://meta.discourse.org/u/kvz)
#### Post date: [8월 19, 2017, 8:18오전 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/12 "2017-08-19T08:18:39Z")
Just tested and it works like a charm! Thanks for the fix, and thanks for a great product!
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 21, 2017, 12:49오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/13 "2017-08-21T12:49:45Z")
Note, the error was actually nothing to do with the CORS origins, instead it was a particular HTML structure our “except parser” exploded on. If you had empty content in certain nodes we were totally unable to generate excerpts, something that broke topic creation.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [6월 8, 2024, 12:44오후 UTC](https://meta.discourse.org/t/multiple-cors-origins-on-hosted-discourse/68172/14 "2024-06-08T12:44:23Z")
이 주제는 2487일 후 자동으로 닫혔습니다. 더 이상 답변을 게시할 수 없습니다.