<p><strong>And it was user rrror</strong></p>
<p>It helps to spell &quot;Content-Security-Policy&quot; correctly.</p>
<p><strong>However, if you still have issues with X-Frame-Options</strong></p>
<p>We are using a docker image for craft which includes an nginx partial: <code>craftcms/security.conf</code></p>
<p><a href="https://github.com/nystudio107/nginx-craft/blob/master/nginx-partials/security.conf" rel="nofollow noreferrer">https://github.com/nystudio107/nginx-craft/blob/master/nginx-partials/security.conf</a></p>
<p>Within that file is the X-Frame-Options header. The solution was to remove the reference to <code>craft/security.conf</code> and migrate its contents to our <code>default.conf</code>.</p>
<p>You can then remove the <code>X-Frame-Options</code> header and inserted your own CSP.</p>

CC BY-SA 4.0
2021-08-30T17:47:22.363Z
2021-08-30T17:47:22.363Z
Mike Robinson
<p><strong>Context</strong></p>
<p>I'm embedding a specific &quot;contact us&quot; page from our marketing site into our web application using an iframe. Our marketing site is the primary domain, while the web application exists on a subdomain (but same top level domain).</p>
<p>When embedding the form page, the browsers refuses to render it because Craft automatically sets <code>X-Frame-Options</code> to <code>sameorigin</code>.</p>
<p><strong>Browser message</strong></p>
<p><code>Refused to display ... in a frame because it set 'X-Frame-Options' to 'sameorigin'.</code></p>
<p><strong>Attempted Fixes</strong></p>
<p>I have tried updating our CSP in nginx to allow for the subdomain, however <code>X-Frame-Options</code> remains present so the browser never allows the embed.</p>
<p><code>add_header Content-Security_Policy &quot;frame-ancestors 'self' *.oursite.com https://localhost:4200;&quot;;</code></p>
<p>I have tried:</p>
<ul>
<li>Using <code>proxy_hide_header 'X-Frame-Options';</code> in our config</li>
<li>Attempting to set <code>{% header &quot;X-Frame-Options: ''&quot; %}</code> in my index.twig</li>
</ul>

<security><embed>
How can I configure Craft security so that my site can be embedded in an iframe?
# How can I configure Craft security so that my site can be embedded in an iframe?

(Asked by: username_0 on 2021-08-30)

**Context**

I'm embedding a specific "contact us" page from our marketing site into our web application using an iframe. Our marketing site is the primary domain, while the web application exists on a subdomain (but same top level domain).

When embedding the form page, the browsers refuses to render it because Craft automatically sets `X-Frame-Options` to `sameorigin`.

**Browser message**

`Refused to display ... in a frame because it set 'X-Frame-Options' to 'sameorigin'.`

**Attempted Fixes**

I have tried updating our CSP in nginx to allow for the subdomain, however `X-Frame-Options` remains present so the browser never allows the embed.

`add_header Content-Security_Policy "frame-ancestors 'self' *.oursite.com https://localhost:4200;";`

I have tried:

* Using `proxy_hide_header 'X-Frame-Options';` in our config
* Attempting to set `{% header "X-Frame-Options: ''" %}` in my index.twig

**Tags:** security, embed


---

## 1 answers

### Answer by username_0 on 2021-08-30. Score: 1

**And it was user rrror**

It helps to spell "Content-Security-Policy" correctly.

**However, if you still have issues with X-Frame-Options**

We are using a docker image for craft which includes an nginx partial: `craftcms/security.conf`

<https://github.com/nystudio107/nginx-craft/blob/master/nginx-partials/security.conf>

Within that file is the X-Frame-Options header. The solution was to remove the reference to `craft/security.conf` and migrate its contents to our `default.conf`.

You can then remove the `X-Frame-Options` header and inserted your own CSP.


---

