Problem/Motivation

Embedding H5P content on a website with a different domain results in an error caused by the X-Frame-Options being set to 'sameorigin'.

Steps to reproduce

Try to embed an H5P in a website with a different domain.

Proposed resolution

Apply the attached patch which removes the X-Frame-Origin header for the h5p.content.embed route.

Remaining tasks

Review and apply the attached patch.

CommentFileSizeAuthor
h5p-x-frame-options-embed-2.patch2.43 KBshaundychko

Comments

ShaunDychko created an issue. See original summary.

shaundychko’s picture

shaundychko
Location Vancouver, Canada
commented
Related issues: +#2612208: embed.php Cross-domain policy option

The D7 issue is #2612208: embed.php Cross-domain policy option

shaundychko’s picture

shaundychko
Location Vancouver, Canada
commented

The solution here of checking for the route name is more reliable than using regex as proposed in the related issue here: https://www.drupal.org/project/h5p/issues/2612208#comment-12476851