# Cross-origin frame problems

**URL:** <https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099>\
**Category:** User Support\
**Created:** [October 24, 2024, 3:15pm UTC](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099 "2024-10-24T15:15:33Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![darshan](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.collaboraonline.com/darshan/32/2230_2.png) [@darshan](https://forum.collaboraonline.com/u/darshan)\
**Post date:** [October 25, 2024, 10:50am UTC](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099/2 "2024-10-25T10:50:11Z")

</div>

hii @gstlouis Welcome to collabora online forums.

### **Adjust Collabora Online Configuration**

To allow embedding and communication across frames, make sure you have set the appropriate `alias_groups` settings in your CODE’s `coolwsd.xml`:

xml

Copy code

```auto
<net>
    <frame_ancestors allow="https://domain.ca https://docs.domain.ca"/>
    <allowedHosts>*</allowedHosts>
</net>

```

This will help ensure that the CODE server allows requests from your app’s domain.

i found a thread which has the similar thing, please refer to this solution once 🙂

> [@Unable to restrict allowed WOPI hosts](https://forum.collaboraonline.com/t/unable-to-restrict-allowed-wopi-hosts/2611/2):
>
> I think I figured it out. Setting the loglevel to “information” reveals the behavior. As expected, when “mode” is set to “first”, then the first host that connects will be added to the list of trusted WOPI hosts. The log message will be: Adding trusted WOPI host: [hostname] Interestingly, the behavior is the same when setting “mode” to “groups” but not defining any groups or only empty groups. Now onto why I could not lock out my own Nextcloud with the setting in my original post: The loca…

Thanks,  
Darshan

---

_[View the full topic](https://forum.collaboraonline.com/t/cross-origin-frame-problems/3099)._