# \[regression\] iframe embedding broken with allowed src domain

**URL:** https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852
**Category:** Support
**Created:** [September 24, 2024, 4:05am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852 "2024-09-24T04:05:49Z")
**Posts on this page:** 19
**Page:** 1

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 4:05am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/1 "2024-09-24T04:05:49Z")

</div>

Hi there, I have added `https://www.tickcounter.com` to my `allowed_iframes`, but this script still doesn’t appear:

`<div style="left:0; width:100%; height:0; position:relative; padding-bottom:25%; margin:0 auto"><iframe src="https://www.tickcounter.com/widget/countdown/5847336" style="top:0; left:0; width:100%; height:100%; position:absolute; border:0; overflow:hidden" title="My countdown"></iframe></div>`

Nothing in the error logs as far as I can see.

It also failed for a different embedded iframe from a different src domain that I allowed.

The exact same sort of embedded iframe from the same src domain worked the last time I tried it, maybe 6 months or a year ago. Now I’m on Discourse v3.3.1 +5 (stable branch).

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 24, 2024, 4:31am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/2 "2024-09-24T04:31:21Z")

</div>

On the latest version of the tests-passed branch, the iframe embeds without issues. Note that the `style` and `title` attributes that you have set will be stripped by Discourse. You can set `width` and `height` attributes though. For example:

```html
<iframe src="https://www.tickcounter.com/widget/countdown/5847336" width="100%"></iframe>

```

What do you see when you navigate to the post and then open the “elements” tab of your browser’s developer tools?

 ![20240923_21h30m07s_grim](https://global.discourse-cdn.com/meta/original/4X/e/0/c/e0c516ba2e1e92442a363afc650af85e1dd9dcee.png)

How about if you open the “console” tab on the developer tools? Are there any errors?

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [September 24, 2024, 4:46am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/3 "2024-09-24T04:46:28Z")

</div>

🤔 hmmm. This seems to be working as expected for me too.

`admin - all site settings - allowed iframes`:

 ![Screenshot 2024-09-23 at 9.43.29 PM](https://global.discourse-cdn.com/meta/original/4X/7/1/b/71b9cfa2e6ed3187d7daa7e73e7814d171c88f8f.png)

previewer:

 ![Screenshot 2024-09-23 at 9.44.44 PM](https://global.discourse-cdn.com/meta/original/4X/c/1/f/c1f21d2dc03ec0420ebb04943543893b1ef73d7f.png)

cooked post:

 ![Screenshot 2024-09-23 at 9.47.44 PM](https://global.discourse-cdn.com/meta/original/4X/b/7/8/b7853506305701a4b8a9b51aa4ec769a06513413.png)

---

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 5:36am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/4 "2024-09-24T05:36:42Z")

</div>

Thanks a lot for the replies.

> [@simon](#):
>
> What do you see when you navigate to the post and then open the “elements” tab of your browser’s developer tools?

`<div class="regular contents"><div class="cooked"></div><section class="post-menu-area clearfix"><nav class="post-controls expanded">`…

> [@simon](#):
>
> How about if you open the “console” tab on the developer tools? Are there any errors?

Hmm there are some errors:

> `Failed to load resource: net::ERR_CONNECTION_REFUSED`  
> [beacon.min.js:1](https://static.cloudflareinsights.com/beacon.min.js)

But that appears to be a DNS blacklist that I’m using. When I connect over a VPN there are no errors. And it seems more than a coincidence that a different user with a completely different computer and network originally reported this same issue to me.

---

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 5:49am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/5 "2024-09-24T05:49:51Z")

</div>

OK Firefox shows me another console message:

> `Partitioned cookie or storage access was provided to “https://www.tickcounter.com/widget/countdown/4471981” because it is loaded in the third-party context and dynamic state partitioning is enabled.`  
> [[Learn more]](https://developer.mozilla.org/en-US/docs/Web/Privacy/Storage_Access_Policy/Errors/CookiePartitionedForeign)

I should also mention that I pasted the iframe code into a skeleton static HTML file and opened it in the browser and it properly loaded the iframe.

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [September 24, 2024, 6:01am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/6 "2024-09-24T06:01:11Z")

</div>

> [@rahim123](#):
>
> beacon.min.js:1

ok this iframe used to work for you… Are you on Cloudflare by chance? if so, perhaps take a look and see if disabling the speed brain thing does anything? (if it is enabled) I know that it is relatively new thing.

> **[Enable and disable Speed Brain - Speed Brain](https://developers.cloudflare.com/speed/optimization/content/speed-brain/#enable-and-disable-speed-brain)**
>
> Speed Brain is available in Cloudflare's Speed tab of the dashboard and also in the API. | Learn how Speed Brain enhances web performance by prefetching likely next pages, improving metrics like LCP and TTFB.

---

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 6:01am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/7 "2024-09-24T06:01:41Z")

</div>

Hi there, no, I don’t use Cloudflare.

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [September 24, 2024, 6:04am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/8 "2024-09-24T06:04:39Z")

</div>

> [@rahim123](#):
>
> I should also mention that I pasted the iframe code into a skeleton static HTML file and opened it in the browser and it properly loaded the iframe.

yes I can get the iframe to work. something is blocking it on your forum.

> [@\[regression\] iframe embedding broken with allowed src domain](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/3):
>
> thinking hmmm. This seems to be working as expected for me too. admin - all site settings - allowed iframes: previewer: cooked post:

---

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 6:18am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/9 "2024-09-24T06:18:39Z")

</div>

> [@Lilly](#):
>
> something is blocking it on your forum

Hmm yep that’s what it looks like. But shouldn’t Discourse have an error in `/logs/` ?

I’m not running anything that I can think of on the server that would block that. I was using the hosting provider’s DNS in my `/etc/resolv.conf`, and I tried switching it to `8.8.8.8` with no change in this issue.

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [September 24, 2024, 6:46am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/10 "2024-09-24T06:46:42Z")

</div>

> [@rahim123](#):
>
> error in `/logs/` ?

only if it causes an error. something might be blocking it as a matter of proper functionality. my guess is to try to figure out if/what changed around the time this stopped working. I wonder if a Content Security Policy change could have affected it.

---

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [September 24, 2024, 6:49am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/11 "2024-09-24T06:49:36Z")

</div>

You seem to say that you’re using a dns block list and it’s breaking things, so don’t use it?

---

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [September 24, 2024, 6:50am UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/12 "2024-09-24T06:50:10Z")

</div>

Did you add

> [@rahim123](#):
>
> `https://www.tickcounter.com`

or

`https://www.tickcounter.com/` to the allowed iframes setting?

---

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 2:10pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/13 "2024-09-24T14:10:01Z")

</div>

> [@pfaffman](#):
>
> You seem to say that you’re using a dns block list and it’s breaking things, so don’t use it?

It’s a DNS service that blocks domains with a bad reputation. But that’s not the issue because 1) when I connect over a VPN it uses a different DNS and this issue continues, and 2) the user that reported this issue to me is using a completely different setup, 3) the DNS configuration is only for my LAN and not on the Discourse server which is failing to generate the proper HTML server-side, and 4) this HTML file properly loads the iframe:

```html
<!DOCTYPE html>
<html lang="en">

<head>
  <meta name="description" content="Webpage description goes here" />
  <meta charset="utf-8">
  <title>Change_me</title>
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="author" content="">
</head>

<body>

<div style="left:0; width:100%; height:0; position:relative; padding-bottom:25%; margin:0 auto"><iframe src="https://www.tickcounter.com/widget/countdown/5847336" style="top:0; left:0; width:100%; height:100%; position:absolute; border:0; overflow:hidden" title="My countdown"></iframe></div>

</body>
</html>

```

> [@Moin](#):
>
> `https://www.tickcounter.com/`

Oh wow, that was it, it was missing the final `/`  
Thanks very much!

Something has changed in Discourse, because I added `https://www.tickcounter.com` the last time I tried this and at that time it worked. In my opinion either the regexp logic it is using or the description of the setting needs to be adjusted, because it says:

> A list of iframe src domain prefixes that discourse can safely allow in posts

When I think of a “domain prefix” I think of a domain name and/or a subdomain, both of which do not include a `/` . Or if it’s supposed to be using more precise logic for complex iframe src URLs then it should say something like:

> A list of iframe src URL prefixes that Discourse can safely allow in posts

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [September 24, 2024, 2:37pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/14 "2024-09-24T14:37:00Z")

</div>

> [@rahim123](#):
>
> Oh wow, that was it, it was missing the final `/`

when you add the link, it should be showing you an error message below the field that you needed another forward slash

 ![image](https://global.discourse-cdn.com/meta/original/4X/1/e/f/1efe14c9f19c51b6415fb634cc11352ec111d49a.png)

---

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [September 24, 2024, 2:41pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/15 "2024-09-24T14:41:43Z")

</div>

The links that were added more than 2 months ago (before the [security fix](https://github.com/discourse/discourse/commit/188cb58daa833839c54c266ce22db150a3f3a210) was merged) are the problem, back then you did not receive an error message and even the default links didn’t contain a third ‘/’.  
This is at least the second support topic because of that

> [@Iframe html being stripped from topic content](https://meta.discourse.org/t/iframe-html-being-stripped-from-topic-content/318348/2):
>
> Could you try adding a trailing slash to the value in allowed iframes and see if that helps? https://docs.google.com/

---

<div class="post-metadata">

### Author: ![Lilly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lilly/32/575047_2.png) [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [September 24, 2024, 2:43pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/16 "2024-09-24T14:43:11Z")

</div>

yea I was wondering if that was the case - that existing links broke somewhere along the way. 🤔

---

<div class="post-metadata">

### Author: ![Moin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/moin/32/554653_2.png) [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [September 24, 2024, 3:20pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/17 "2024-09-24T15:20:56Z")

</div>

Is it possible to check the existing input and notify admins about links that don’t work anymore?

---

<div class="post-metadata">

### Author: ![rahim123](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@rahim123](https://meta.discourse.org/u/rahim123)
#### Post date: [September 24, 2024, 3:26pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/18 "2024-09-24T15:26:09Z")

</div>

For me I think the biggest source of confusion was the fact that it’s called a “domain” when it’s actually a URL.  
[https://github.com/discourse/discourse/pull/28997](https://github.com/discourse/discourse/pull/28997)

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [October 24, 2024, 3:27pm UTC](https://meta.discourse.org/t/regression-iframe-embedding-broken-with-allowed-src-domain/327852/19 "2024-10-24T15:27:06Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.