Title: Unexpected error when loading XBlocks in MFE (X-Frame-Options: SAMEORIGIN issue?)

Site Operators Site Operations Help
,
1

Hello,

I have used How to Get Help search.
I also went through related discussions on the forums (about X-Frame-Options, iframes, and CSP headers). While they provide useful context, they don’t provide a ready-to-use solution for my setup. My environment is Ubuntu 24.04.2 LTS with Tutor 20.0.0 (Teak), running with LMS on healthyorg.eu, Studio on studio.healthyorg.eu, and MFEs on apps.healthyorg.eu. The threads I found mostly focus on older Tutor versions with Nginx or different configurations, so I’m not sure how to correctly apply those fixes in my case.

I’m deploying Open edX using Tutor 20.0.0 with the following setup:

  • LMS: https://healthyorg.eu

  • MFE apps: https://apps.healthyorg.eu

  • Tutor deployment on Ubuntu 24.04.2 LTS Caddy as reverse proxy

When opening a course unit inside the Learning MFE, the iframe with LMS content fails to load correctly.
Here is a sample request/response:

Request:
URL: https://healthyorg.eu/xblock/block-v1:OpenedX+DemoX+DemoCourse+type@vertical+block@78b75020d3894fdfa8b4994f97275294
Referer: https://apps.healthyorg.eu/

Response headers:
Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Vary: Cookie, Accept-Language, origin, Accept-Encoding
Status: 200

The iframe is blocked because the LMS sends X-Frame-Options: SAMEORIGIN, but the request is coming from a different subdomain (apps.healthyorg.eu).

I have already set in Tutor config:

CSRF_TRUSTED_ORIGINS=["https://healthyorg.eu","https://apps.healthyorg.eu"]
CORS_ORIGIN_WHITELIST=["https://apps.healthyorg.eu"]
SESSION_COOKIE_DOMAIN=".healthyorg.eu"
CSRF_COOKIE_DOMAIN=".healthyorg.eu"

But the issue persists.

My question:
Is it with X-Frame-Options: SAMEORIGIN issue?
If so how to solve it
:backhand_index_pointing_right: How can I configure LMS so that the XBlocks (student_view) can be embedded correctly inside the MFE iframe (cross-subdomain)?

Any guidance on the correct Tutor/edx-platform settings for this scenario would be very helpful.

Thank you!

2

@arbrandes any ideas here?

3

The configuration looks correct in principle. @Borys, did you change the corresponding Tutor settings in response to the error, or did you start by changing the settings? I’m trying to understand if you’re trying to enhance security, or just running into an error with the default configuration.

4

Hey.
Thanks for replay.
I have changed the settings in response to the error. I am running into an error with the default configuration - its not about enhancing security. When opening a course unit (for example - unit in Default OpenEdx demo course) inside the Learning MFE, the iframe with LMS content fails to load correctly. I see course structure but I don’t see videos. texts, quizes etc. This is my biggest challange to face at the moment.

5

Hey
Can you help me with my issue?

7

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.