# Running Discourse in an iframe
**URL:** https://meta.discourse.org/t/running-discourse-in-an-iframe/54931
**Category:** Support
**Created:** [December 29, 2016, 2:45pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931 "2016-12-29T14:45:26Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@fishb6nes](https://meta.discourse.org/u/fishb6nes)
#### Post date: [December 29, 2016, 2:45pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/1 "2016-12-29T14:45:26Z")
I’m looking to gain more experience with Angular and Node (as that is what is being used in my work place) and want to use a website idea I’ve been shelving for quite a while now. Initially I expected to simply run Discourse in an iframe in the Angular app, but it’s never that easy.
Are there very clear reasons not to meddle with the `X-Frame-Options`, including loosening it to `ALLOW-FROM`? What would be the most elegant approach to integrating Discourse in an Angular SPA or am I barking up the wrong tree?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 29, 2016, 2:48pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/2 "2016-12-29T14:48:36Z")
> [@fishb6nes](#):
>
> I barking up the wrong tree
Discourse living in an iframe isn’t a common use. You can try, of course, but it’s not something we recommend.
---
### Author:  [@fishb6nes](https://meta.discourse.org/u/fishb6nes)
#### Post date: [December 29, 2016, 4:50pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/3 "2016-12-29T16:50:41Z")
How would one go about changing the default `X-Frame-Options` setting within Discourse? I’ve been trying to update
`Rails.configuration.middleware.use Rack::Protection::FrameOptions`
To
`Rails.configuration.middleware.use Rack::Protection::FrameOptions, :frame_options => "ALLOWALL"`
in
`config/initializers/011-rack-protection.rb`
and then restarting the unicorn, but that doesn’t seem to be what I’m looking for (it doesn’t work).
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 29, 2016, 5:07pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/4 "2016-12-29T17:07:46Z")
I think it’s a matter of just adding the host in `/admin/customize/embedding` instead of messing with the code to get this header.
---
### Author:  [@fishb6nes](https://meta.discourse.org/u/fishb6nes)
#### Post date: [December 29, 2016, 5:14pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/5 "2016-12-29T17:14:43Z")
Ah, my bad, for some reason I assumed that was only for embedding comments. I will have a look, thank you.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 29, 2016, 5:17pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/6 "2016-12-29T17:17:13Z")
That will add the header `x-frame-options:ALLOWALL` on the /embed route that will allow you to test your setup.
If, after testing you still wanna go with this iframe route, I guess adding this header in a reverse proxy is the easiest way.
---
### Author:  [@fishb6nes](https://meta.discourse.org/u/fishb6nes)
#### Post date: [December 29, 2016, 5:35pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/7 "2016-12-29T17:35:33Z")
Well, another issue is the URL not updating if the user switches views in the iframe. Which would raise another issue with `document.getElementById("iframe_id").contentWindow.location.href` not being available cross origin. It might be a better idea to serve Discourse out of a folder and keep everything on the same origin.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [December 29, 2016, 5:40pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/8 "2016-12-29T17:40:25Z")
> [@fishb6nes](#):
>
> It might be a better idea to serve Discourse out of a folder and keep everything on the same origin.
YES!
What everyone does is having `mainapp.com` and `discourse.mainapp.com`.
You just add the same font, background, header, etc and it’s the same site for your users.
---
### Author:  [@fishb6nes](https://meta.discourse.org/u/fishb6nes)
#### Post date: [December 29, 2016, 6:19pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/9 "2016-12-29T18:19:31Z")
Those are not on the same origin 😋 but I can compromise and split the site into 2 apps, the Angular app as the landing page and the Discourse app as the community solution supporting it. I was looking to tightly integrate the too, but might even be a better idea to keep them separate and access the Discourse data I’m after through the API.
Thanks Falco
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [April 14, 2019, 10:28am UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/10 "2019-04-14T10:28:30Z")
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [April 24, 2019, 5:35pm UTC](https://meta.discourse.org/t/running-discourse-in-an-iframe/54931/11 "2019-04-24T17:35:02Z")
Running Discourse in an `