Document settings.iframe.allowed-parent-origins in site settings and em… - #7016
Open
fern-api[bot] wants to merge 1 commit into
Open
fern-api[bot] wants to merge 1 commit into
fern-api[bot] wants to merge 1 commit into
Conversation
fern-api
Bot
requested review from
devalog,
jkonrath-postman and
nerminamiller-postman
as code owners
September 18, 2026 22:47
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| - https://*.example.com | ||
| ``` | ||
|
|
||
| Each entry must be a valid CSP host source (`scheme://host[:port]`). Wildcards on the host label (`https://*.example.com`) are supported; bare `*`, keyword sources, and scheme-only values are rejected. The configured origins are appended to the default `frame-ancestors`, so `'self'` and `https://*.buildwithfern.com` remain in place. |
Contributor
There was a problem hiding this comment.
📝 [vale] <FernStyles.Acronyms> reported by reviewdog 🐶
'CSP' has no definition.
|
|
||
| <Indent> | ||
| <ParamField path="settings.iframe.allowed-parent-origins" type="list of strings" required={false} toc={true}> | ||
| A list of origins to append to the `Content-Security-Policy: frame-ancestors` directive, allowing those origins to embed your docs in an iframe. Each entry must be a valid CSP host source of the form `scheme://host[:port]` (e.g. `https://app.example.com`, `https://*.example.com`). Bare wildcards (`*`), keyword sources (`'none'`, `'self'`), scheme-only sources (`https:`), and entries with paths are rejected. |
Contributor
There was a problem hiding this comment.
📝 [vale] <FernStyles.Acronyms> reported by reviewdog 🐶
'CSP' has no definition.
Contributor
|
🌿 Preview your docs: https://fern-preview-2026-09-18-fern-ai-1fb7a4-d9f1c6c5.docs.buildwithfern.com/learn Here are the markdown pages you've updated: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added documentation for the new
settings.iframe.allowed-parent-originsdocs.yml key in two places. In the Settings configuration section of the site settings page, a newsettings.iframe<ParamField>entry (with a nestedsettings.iframe.allowed-parent-originsfield) was added aftersettings.substitute-env-vars, along withiframein the YAML example block. In the embedded mode page, a new "Allow third-party origins to frame your docs" section was added between "Enable embedded mode" and "Embed external pages", explaining the default CSPframe-ancestorsbehavior and how to configure specific origins without using?embedded=true.