I am embedding content in my article that are from the same domain. when I am opening my url with HTTP the embedded HTTPS content won't open and when I am opening my url with HTTPS the embedded HTTP content won't open. Same thing happen when i try to open content with localhost. I am getting this error in Firefox and Chrome:

Load denied by X-Frame-Options: http://mywebsite.com/embed/clips/sandy does not permit cross-origin framing.   


 Refused to display 'https://mywebsite.com/embed/clips/sandy' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

I installed the CORS module but it does not seems to help. In Domains (/admin/config/services/cors) I added:


without success. Any insight is apreciated.


https and http -- even if the host is the same -- are considered different domains.

The way you can deal with that when your site can be viewed with both https and http, is instead of referencing files https:// or http:// just use // It will defer to the protocol that you are on.

The only time this would cause problems would be if a certain resource only got served up under secure or insecure. But this does not sound like it would be a problem for you in this instance.

EDIT: In order to change existing content, which it sounds like doing by hand is impossible. You could try a module like https://www.drupal.org/project/scanner -- being careful to backup, test, and make sure you are only looking at the correct URLs (you don't want to change the urls where changing the protocol would be).

One other possible way to make it work is to just make your path references root relative -- strip out http://yourdomain.com - and just leave /your/path/to/file

The other thing to do is just cherry pick the content that people are looking at most.

|improve this answer|||||
  • very helpful, thanks. but how will I deal with existing content (over 10K of articles with embedded content). – mamesaye Dec 8 '16 at 2:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.