Blocked by x-frame policy

[jen_anderson]

In the last two months we are now getting the message that items are blocked by the --frame-policy. This in happening on anything using an iframe, Stream videos that are embedded, Power Points that are embedded, websites that are added with an iframe.

How can we add items without getting this message? The one I tried today was adding a Stream video to a module as an external URL. This should be doable.

[themidiman · Accepted solution]

There's another discussion about that here: https://community.canvaslms.com/message/196709-re-x-frame-blocks-against-i-frames?commentID=196709 

The TL;DR; is that the originating web host is responsible for setting the block. In other words, they don't want their content embedded in someone else's website. 

[kevinkatler]

You cannot display a lot of websites inside an iFrame. Reason being that they send an "X-Frame-Options: SAMEORIGIN" response header. This option prevents the browser from displaying iFrames that are not hosted on the same domain as the parent page.

I faced the same error when displaying YouTube links. For example: https://www.youtube.com/watch?v=8WkuChVeL0s

I replaced watch?v= with embed/ so the valid link will be: https://www.youtube.com/embed/8WkuChVeL0s

It works well.

Try to apply the same rule on your case.

SAMEORIGIN

The page can only be displayed in a frame on the same origin as the page itself. The spec leaves it up to browser vendors to decide whether this option applies to the top level, the parent, or the whole chain, although it is argued that the option is not very useful unless all ancestors are also in the same origin.