LiveView in IFrame blocked due to X-Frame-Options = SAMEORIGIN

[rhcarvalho]

There are a few threads about LiveViews on iframes now. For anyone landing here in the future, this is the current solution I’ve found:

---

After trying several things I gathered around the internet, I found the 3 minimal steps which limit security-related changes to the embeddable LiveViews only.

Embed a LiveView via iframe (solution)

After collecting information from multiple sources (this forum, blogs, StackOverflow and GitHub), I was finally able to successfully embed part of an existing Phoenix LiveView app in an iframe. I’d like to share the steps here, both for future reference and to hopefully help others. If you find this useful, please let me know. Do you think the official docs should contain a small guide on this topic? Configuring a LiveView app to be embeddable via iframe There are luckily only a few changes t…

• Separate LiveView Socket.
• Separate Router Pipeline replacing x-frame-options HTTP header with a restrictive CSP.
• Separate layout for embeddable LiveViews independent from session-based assigns.