Answers.Body: <p><strong>And it was user rrror</strong></p>
  <p>It helps to spell &quot;Content-Security-Policy&quot; correctly.</p>
  <p><strong>However, if you still have issues with X-Frame-Options</strong></p>
  <p>We are using a docker image for craft which includes an nginx partial: <code>craftcms/security.conf</code></p>
  <p><a href="https://github.com/nystudio107/nginx-craft/blob/master/nginx-partials/security.conf" rel="nofollow noreferrer">https://github.com/nystudio107/nginx-craft/blob/master/nginx-partials/security.conf</a></p>
  <p>Within that file is the X-Frame-Options header. The solution was to remove the reference to <code>craft/security.conf</code> and migrate its contents to our <code>default.conf</code>.</p>
  <p>You can then remove the <code>X-Frame-Options</code> header and inserted your own CSP.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-30T17:47:22.363Z
Answers.LastActivityDate: 2021-08-30T17:47:22.363Z
Answers.UserDisplayName: Mike Robinson
Body: <p><strong>Context</strong></p>
  <p>I'm embedding a specific &quot;contact us&quot; page from our marketing site into our web application using an iframe. Our marketing site is the primary domain, while the web application exists on a subdomain (but same top level domain).</p>
  <p>When embedding the form page, the browsers refuses to render it because Craft automatically sets <code>X-Frame-Options</code> to <code>sameorigin</code>.</p>
  <p><strong>Browser message</strong></p>
  <p><code>Refused to display ... in a frame because it set 'X-Frame-Options' to 'sameorigin'.</code></p>
  <p><strong>Attempted Fixes</strong></p>
  <p>I have tried updating our CSP in nginx to allow for the subdomain, however <code>X-Frame-Options</code> remains present so the browser never allows the embed.</p>
  <p><code>add_header Content-Security_Policy &quot;frame-ancestors 'self' *.oursite.com https://localhost:4200;&quot;;</code></p>
  <p>I have tried:</p>
  <ul>
  <li>Using <code>proxy_hide_header 'X-Frame-Options';</code> in our config</li>
  <li>Attempting to set <code>{% header &quot;X-Frame-Options: ''&quot; %}</code> in my index.twig</li>
  </ul>
  
Tags: <security><embed>
Title: How can I configure Craft security so that my site can be embedded in an iframe?
ThreadText: # How can I configure Craft security so that my site can be embedded in an iframe?
  
  (Asked by: username_0 on 2021-08-30)
  
  **Context**
  
  I'm embedding a specific "contact us" page from our marketing site into our web application using an iframe. Our marketing site is the primary domain, while the web application exists on a subdomain (but same top level domain).
  
  When embedding the form page, the browsers refuses to render it because Craft automatically sets `X-Frame-Options` to `sameorigin`.
  
  **Browser message**
  
  `Refused to display ... in a frame because it set 'X-Frame-Options' to 'sameorigin'.`
  
  **Attempted Fixes**
  
  I have tried updating our CSP in nginx to allow for the subdomain, however `X-Frame-Options` remains present so the browser never allows the embed.
  
  `add_header Content-Security_Policy "frame-ancestors 'self' *.oursite.com https://localhost:4200;";`
  
  I have tried:
  
  * Using `proxy_hide_header 'X-Frame-Options';` in our config
  * Attempting to set `{% header "X-Frame-Options: ''" %}` in my index.twig
  
  **Tags:** security, embed
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-08-30. Score: 1
  
  **And it was user rrror**
  
  It helps to spell "Content-Security-Policy" correctly.
  
  **However, if you still have issues with X-Frame-Options**
  
  We are using a docker image for craft which includes an nginx partial: `craftcms/security.conf`
  
  <https://github.com/nystudio107/nginx-craft/blob/master/nginx-partials/security.conf>
  
  Within that file is the X-Frame-Options header. The solution was to remove the reference to `craft/security.conf` and migrate its contents to our `default.conf`.
  
  You can then remove the `X-Frame-Options` header and inserted your own CSP.
  
  
  ---
  
  