# Embedding Dradis in iFrame

**URL:** <https://discuss.dradis.com/t/embedding-dradis-in-iframe/518>\
**Category:** Community Edition\
**Created:** [December 29, 2017, 6:07am UTC](https://discuss.dradis.com/t/embedding-dradis-in-iframe/518 "2017-12-29T06:07:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![berniemoran](https://avatars.discourse-cdn.com/v4/letter/b/7993a0/32.png) [@berniemoran](https://discuss.dradis.com/u/berniemoran)\
**Post date:** [December 29, 2017, 6:07am UTC](https://discuss.dradis.com/t/embedding-dradis-in-iframe/518/1 "2017-12-29T06:07:44Z")

</div>

Looking for a way to override the default Rails behavior of prohibiting display within an iFrame.  
Having little knowledge of Rails, have tried adding the following to config/application.rb and in config/environments for development or production:

config.action\_dispatch.default\_headers = {‘X-Frame-Options’ =\> ‘ALLOWALL’}

This has worked in other Rails deployments, but not it seems for Dradis.  
Is there a way of configuring this?

---

<div class="post-metadata">

**Author:** ![xavi](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.dradis.com/xavi/32/102_2.png) [@xavi](https://discuss.dradis.com/u/xavi)\
**Post date:** [December 29, 2017, 7:34am UTC](https://discuss.dradis.com/t/embedding-dradis-in-iframe/518/2 "2017-12-29T07:34:00Z")

</div>

What you said seems the way to go to achieve this.

Also make sure to try it in a incognito window so the browser cache does not bother you, as mentioned here: [responsive design - Cannot display my rails 4 app in iframe even if 'X-Frame-Options' is 'ALLOWALL' - Stack Overflow](https://stackoverflow.com/questions/17542511/cannot-display-my-rails-4-app-in-iframe-even-if-x-frame-options-is-allowall/29811391)

If that doesn’t help, please try the second solution on that same thread: [responsive design - Cannot display my rails 4 app in iframe even if 'X-Frame-Options' is 'ALLOWALL' - Stack Overflow](https://stackoverflow.com/a/17862331)

---

<div class="post-metadata">

**Author:** ![berniemoran](https://avatars.discourse-cdn.com/v4/letter/b/7993a0/32.png) [@berniemoran](https://discuss.dradis.com/u/berniemoran)\
**Post date:** [December 30, 2017, 3:03am UTC](https://discuss.dradis.com/t/embedding-dradis-in-iframe/518/3 "2017-12-30T03:03:06Z")

</div>

Thanks for help. It looks like the second solution might be the one, but just not sure where to include this block in the Dradis framework.

class MyController \< ApplicationController  
def iframe\_action  
response.headers.delete “X-Frame-Options”  
render\_something  
end  
end

Should this go in the application.rb file?

---

<div class="post-metadata">

**Author:** ![xavi](https://yyz1.discourse-cdn.com/flex035/user_avatar/discuss.dradis.com/xavi/32/102_2.png) [@xavi](https://discuss.dradis.com/u/xavi)\
**Post date:** [January 10, 2018, 6:32am UTC](https://discuss.dradis.com/t/embedding-dradis-in-iframe/518/4 "2018-01-10T06:32:27Z")

</div>

That should be `app/controllers/application_controller.rb`

I think you have to use an `after_filter` or `before_filter`, since it is not a single action that you want in the iframe, it’s the whole app.