# Flowfuse cross domain settings (cor?)

**URL:** <https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317>\
**Category:** FlowFuse\
**Tags:** http-request\
**Created:** [18 April 2024 15:31 UTC](https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317 "2024-04-18T15:31:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BryanOgd](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bryanogd/32/10187_2.png) [@BryanOgd](https://discourse.nodered.org/u/BryanOgd)\
**Post date:** [18 April 2024 15:31 UTC](https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317/1 "2024-04-18T15:31:23Z")

</div>

need a cross domain iframe  
which I think is usually done via the settings.js

```auto
{
  "origin": "*",
  "methods": "GET,PUT,POST,DELETE",
  "optionsSuccessStatus": 204,
  "headers": {
    "Content-Security-Policy": "frame-ancestors 'self' https://example.com;"
  }
}

```

what is the method in flow fuse?

---

<div class="post-metadata">

**Author:** ![BryanOgd](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bryanogd/32/10187_2.png) [@BryanOgd](https://discourse.nodered.org/u/BryanOgd)\
**Post date:** [8 August 2024 16:35 UTC](https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317/2 "2024-08-08T16:35:01Z")

</div>

Can I get a bump here - I wasn't having any issues with cross domain posting until I updated flow fuse now my forge rejects the iframe call

basically I have a chatbot distributed through a http node - that gives me the following error when embedded in an iframe @ **[forge.ai4socialservice.com](http://forge.ai4socialservice.com)** refused to connect.

\*\*\*note what IM trying to do is embed the http node link output html in a iframe not the editor

Any help with this appreciated

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [8 August 2024 16:44 UTC](https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317/3 "2024-08-08T16:44:01Z")

</div>

Hi @BryanOgd

I think you're hitting this issue: [CSP policy getting applied to httpNode routes · Issue #262 · FlowFuse/nr-launcher · GitHub](https://github.com/FlowFuse/nr-launcher/issues/262)

I'll bump it up to get looked at sooner.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [8 August 2024 16:45 UTC](https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317/4 "2024-08-08T16:45:58Z")

</div>

@BryanOgd as noted in the linked issue, a potential workaround is to edit your instance settings to modify the path the editor is served from. By default that is `/` - which causes its security policy to get applied to all requests. If you were to change that to, for example `/editor`, then the routes served by your node-red flows shouldn't get the security policy applied.

---

<div class="post-metadata">

**Author:** ![BryanOgd](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bryanogd/32/10187_2.png) [@BryanOgd](https://discourse.nodered.org/u/BryanOgd)\
**Post date:** [8 August 2024 17:16 UTC](https://discourse.nodered.org/t/flowfuse-cross-domain-settings-cor/87317/5 "2024-08-08T17:16:28Z")

</div>

thanks I do have my editors at their own links. -- IFRAMED placement of http links generated by node-red works in my instal of flowfuse v2.1.0 and now not in v3.0.1

This brought up another issue as I vainly tried to effect the cross domain settings in my host with

Open the `flowforge.yml` file and ensure it allows embedding from your domain. Add or modify the following settings:

```auto
server:
  # Other settings...

  headers:
    Content-Security-Policy: "frame-ancestors 'self' https://impactaiinc.com"
    X-Frame-Options: "ALLOW-FROM https://impactaiinc.com"

  # Other settings...

```

However when I tried docker compose up I got wacky ngnix 502 errors V3.0.1  
So I just saved the flows and reinstalled the whole flowfuse and now Im scared to even touch flowforge.yml or really even restart the flowfuse at all - but this still leaves me without a chatbot embedded in another off domain webpage

I saw a recent 502 errors post that required an update -- 😕