Form embedding webpage error

[Neodrex]

After embedding the form in a wordpress page on a separate site, I keep getting the brower error saying the domain will not allow the browser to display the page if another site has embedded it. Is there a configuration to resolve this?

[iMuFeng]

The simplest way is to delete this line:

heyform/packages/server/src/controller/dashboard.controller.ts

Line 19 in 19e0b2a

@Header('X-Frame-Options', 'SAMEORIGIN')

You can also only allow the /form/* pages to be embeded in other website. Add the following route for /form/*

@Controller()
export class DashboardController {
  @Get('/form/*')
  // No `X-Frame-Options` header here 
  form(@Res() res: Response) {
    return res.render('index', {
      rendererData: {
        homepageURL: APP_HOMEPAGE_URL,
        cookieDomain: COOKIE_DOMAIN,
        stripePublishableKey: STRIPE_PUBLISHABLE_KEY,
        geetestCaptchaId: GEETEST_CAPTCHA_ID,
        googleRecaptchaKey: GOOGLE_RECAPTCHA_KEY,
        appDisableRegistration: APP_DISABLE_REGISTRATION,
        disableLoginWithApple: DISABLE_LOGIN_WITH_APPLE,
        disableLoginWithGoogle: DISABLE_LOGIN_WITH_GOOGLE,
        verifyUserEmail: VERIFY_USER_EMAIL
      }
    })
  }

  @Get('/*')
  @Header('X-Frame-Options', 'SAMEORIGIN')
  index(@Res() res: Response) {
    // ...
  }
}

[Neodrex]

Thanks for your reply. It didn't seem to work after applying both fixes. Please view the test page here - https://www.arnet.co.uk/test-page-3/

Thanks again for your assistance.

[iMuFeng]

I noticed that the X-Frame-Options response header is still present. If possible, please restart HeyForm after making the changes.

[Neodrex]

The changes were made and the instance restarted. Still no difference, is there something else we need to change?

[iMuFeng]

We will release a new version to fix this issue

[Neodrex]

Thanks. Please does the latest version include the fix?

[iMuFeng]

Yes, version 0.0.12 fixes it.

[Neodrex]

The latest docker version seems to still be on 0.0.9.

[Neodrex]

Thanks, sorted the update. It's all working now.