I have a published app embedded in a static page, and it was working as of a few months ago. I’ve recently started work on it again, and today I find that the app will no longer load in the iframe, and the following message shows up in Chrome’s Console:
Refused to display ‘https://[myapp].anvil.app/’ in a frame because an ancestor violates the following Content Security Policy directive: “frame-ancestors https://anvil.works”.
My understanding is that this means Anvil is only allowing my app to be embedded in a website hosted on the anvil.works domain (despite having the “Embed my app in a web page” box checked in the “Publish app…” menu). Any advice?
Hi @hugetim,
To embed an Anvil app in another page, you’ll need to allow embedding in the Publish dialog:
I do have that box checked. But one question I have is whether it is only the current status of that box that matters–for both development and published versions?
Is it possible the published version is not allowing embedding (because that box was not checked at the time the published version was saved, say), although the development version is?
In my particular case, if anything, it may be a mangled git merge from a separate “test” version of the app (for which embedding is not allowed) through which I have switched the published embed setting off “under the hood.” I’ll try some more things troubleshooting-wise and see if I can reproduce this in an app I can clone and share.
The state of that box is stored as part of your app’s source code (if you check your app out with Git, you’ll find it in anvil.yaml). So it’s entirely possible for your published version not to permit embedding while your dev version does.
(You can use the “Restore this version” option to go back to your Published version and find out - or even modify it. Then you can restore back to where you left off in your development version, and still work on that.)
1 Like
(You can use the “Restore this version” option to go back to your Published version and find out - or even modify it. Then you can restore back to where you left off in your development version, and still work on that.)
So so helpful! I have always been worried to use the “Restore this version” option for fear that I would not be able to restore back to where I left off.
Restoring to the published version revealed that embedding was indeed turned off in that version. Checking that box and publishing the fixed version did the trick. Thank you so much for saving me the time it would have taken me to figure this out on my own! 
1 Like
I think I just experienced a bug in the ability to “re-restore” where I left off in the developed version after restoring to an old version. Here was the sequence:
- I cloned the app here: https://anvil.works/forum/t/toggle-switch-demo-custom-html/
- I renamed it
- I changed its dependencies package name
- I manually saved and published the new version.
- Then I restored the original version, with commit message “Cloned app”
- When I went to restore the renamed version, it was gone.
So, no big loss, but it just gives me pause about restoring old versions when I think I may want to return to the latest version.
The name is also stored partially in Git (this will change soon); as a result, the app might have changed name when you restored! If you refresh the editor and check all the apps in your account, I am fairly certain the code will still be there.
1 Like
Thanks, that’s good to know. I’m actually not able to replicate the problem now, so apparently there was something else that I did beyond those steps I listed that contributed.
