# Recording playback URLs started returning X-Frame-Options: SAMEORIGIN, breaking our iframe embedding

**URL:** <https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059>\
**Category:** API and Webhooks\
**Created:** [September 30, 2019, 12:06am UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059 "2019-09-30T00:06:40Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikhail](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/mikhail/32/1969_2.png) [@mikhail](https://devforum.zoom.us/u/mikhail)\
**Post date:** [September 30, 2019, 12:06am UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/1 "2019-09-30T00:06:40Z")

</div>

**Description/Error**  
A clear and concise description of what the question is. If it is an error, please post the full error message with the error/response code.

**Which Endpoint/s?**  
Knowing the endpoint/s can help us to identify your issue faster. Please link the ones you need help/have a question with.

**How To Reproduce (If applicable)**  
Sample URL:

> **[Video Conferencing, Web Conferencing, Webinars, Screen Sharing](https://outschool.zoom.us/recording/play/a8d61de8-afb2-46ae-8d58-1999463fd209)**
>
> Zoom is the leader in modern enterprise video communications, with an easy, reliable cloud platform for video and audio conferencing, chat, and webinars across mobile, desktop, and room systems. Zoom Rooms is the original software-based conference...

**Screenshots (If applicable)**  
If applicable, add screenshots to help explain your problem.

From a similar URL showing the sameorigin header.

 ![46%20PM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/f/f28e12c457bc8cc7340aa646c29d9880d5668f82.png)

**Additional context**  
We’ve had embedded recording playback as a feature on our website since late 2017. Apparently Zoom deployed a change in the last day or so to add the sameorigin header to the playback page, breaking our behavior and generating a number of customer complaints for us.

---

<div class="post-metadata">

**Author:** ![lucas.cioffi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/lucas.cioffi/32/1977_2.png) [@lucas.cioffi](https://devforum.zoom.us/u/lucas.cioffi)\
**Post date:** [September 30, 2019, 11:59am UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/2 "2019-09-30T11:59:37Z")

</div>

I have a similar problem that @mikhail reported . I believe Zoom might have changed their X-Frame-Options recently, and unfortunately this has broken my app too.

I was embedding a hidden iframe, and when I changed the src of that iframe, it was an easy way to open Zoom without the user having to go to a new browser tab.

Here is the error message in the browser’s JavaScript console:  
“Load denied by X-Frame-Options: [https://zoom.us/j/123123123](https://zoom.us/j/123123123) does not permit cross-origin framing.”

Having to open up Zoom in a new tab will significantly detract from our user experience.

---

<div class="post-metadata">

**Author:** ![edward](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edward/32/1829_2.png) [@edward](https://devforum.zoom.us/u/edward)\
**Post date:** [September 30, 2019, 5:34pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/3 "2019-09-30T17:34:49Z")

</div>

We have a very similar use case as @lucas.cioffi. Hidden embedded iFrame that launches the zoom client for the most seamless experience of joining a zoom meeting from our app.

This change has broken a core functionality of our app.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 30, 2019, 6:50pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/4 "2019-09-30T18:50:21Z")

</div>

Hey @mikhail, @lucas.cioffi, and @edward,

Thanks for bringing this to our attention, and apologies this happened. We have just fixed the issue.

It should work now 🙂

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![edward](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edward/32/1829_2.png) [@edward](https://devforum.zoom.us/u/edward)\
**Post date:** [September 30, 2019, 7:03pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/5 "2019-09-30T19:03:12Z")

</div>

Hey @tommy, thank you for quickly passing this along.

However, we are still running into an issue with the same-origin policy:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/2X/0/075b637e843fa2655735da911cb384afc6bf50c9.png)

---

<div class="post-metadata">

**Author:** ![mikhail](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/mikhail/32/1969_2.png) [@mikhail](https://devforum.zoom.us/u/mikhail)\
**Post date:** [September 30, 2019, 7:31pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/6 "2019-09-30T19:31:17Z")

</div>

Thanks @tommy, we’ve confirmed the fix on our side - recordings work again when embedded in an iframe. Appreciate the prompt resolution!

Would love to know more about the cause, if there’s anything you can share.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 30, 2019, 8:17pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/7 "2019-09-30T20:17:10Z")

</div>

Hey @edward, we are working on a fix for the X-Frame embedding start and join urls.

I will post back here with updates!

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 30, 2019, 8:17pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/8 "2019-09-30T20:17:57Z")

</div>

Happy to hear @mikhail, I will post back here with an update after we resolve the remaining X-Frame errors.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 30, 2019, 9:40pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/10 "2019-09-30T21:40:56Z")

</div>

Hey @edward ,

This should be fixed now. Please let me know if it works!

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![edward](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/edward/32/1829_2.png) [@edward](https://devforum.zoom.us/u/edward)\
**Post date:** [September 30, 2019, 10:00pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/12 "2019-09-30T22:00:12Z")

</div>

Yes this is working now, thank you!

Could we get some context around these decisions? We have a number of frustrated users as we were incapable of preparing for this situation. We also had to consider immediate long term changes to our application wrt Zoom as it was unclear if this change was intentional or not.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 30, 2019, 10:25pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/13 "2019-09-30T22:25:06Z")

</div>

Hey @edward, happy to hear it is working, and our sincerest apologies this happened!

We released half of a feature accidentally over the weekend which caused this issue. We have since reverted, and are working to make sure this does not happen again.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![lucas.cioffi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/lucas.cioffi/32/1977_2.png) [@lucas.cioffi](https://devforum.zoom.us/u/lucas.cioffi)\
**Post date:** [October 1, 2019, 1:13am UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/14 "2019-10-01T01:13:27Z")

</div>

Hello @tommy thank you very, very much for these prompt fixes! That solved our main problem.

There’s one more path that I found which is not yet working: [https://zoom.us/wc/JOIN\_ID\_GOES\_HERE](https://zoom.us/wc/JOIN_ID_GOES_HERE)

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 1, 2019, 6:39pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/15 "2019-10-01T18:39:15Z")

</div>

You are welcome, our engineers worked promptly to fix 🙂

/wc should be working. What is the error you are getting?

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![lucas.cioffi](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/lucas.cioffi/32/1977_2.png) [@lucas.cioffi](https://devforum.zoom.us/u/lucas.cioffi)\
**Post date:** [October 3, 2019, 3:37am UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/16 "2019-10-03T03:37:50Z")

</div>

Hello, Tommy, here is the error:

```auto
Refused to display 'https://zoom.us/wc/ID_GOES_HERE/join?prefer=1&un=THVjYXMgQ2lvZmZp' in a frame because it set 'X-Frame-Options' to 'deny'.

```

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 3, 2019, 3:24pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/18 "2019-10-03T15:24:39Z")

</div>

Thanks @lucas.cioffi, our engineers are working on it, and I will update you once it is fixed!

Thanks for your patience 🙂

-Tommy

---

<div class="post-metadata">

**Author:** ![sbarty](https://avatars.discourse-cdn.com/v4/letter/s/7bcc69/32.png) [@sbarty](https://devforum.zoom.us/u/sbarty)\
**Post date:** [October 9, 2019, 8:01pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/19 "2019-10-09T20:01:32Z")

</div>

@tommy any update on this? It’s been over a week and is causing a lot of confusion for our users.

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 9, 2019, 8:03pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/20 "2019-10-09T20:03:36Z")

</div>

Hey @sbarty,

Yes we have a fix, and it should be released next week.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 10, 2019, 4:45pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/21 "2019-10-10T16:45:28Z")

</div>

Hey @sbarty, @lucas.cioffi, and everyone,

We will have this (/wc path) fixed in a release coming this weekend.

Thanks again for your patience.

-Tommy

---

<div class="post-metadata">

**Author:** ![sbarty](https://avatars.discourse-cdn.com/v4/letter/s/7bcc69/32.png) [@sbarty](https://devforum.zoom.us/u/sbarty)\
**Post date:** [October 14, 2019, 5:26pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/23 "2019-10-14T17:26:09Z")

</div>

@tommy just wanted to follow up on this and verify that the fix went live this past weekend. Thanks!

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 14, 2019, 5:42pm UTC](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059/24 "2019-10-14T17:42:44Z")

</div>

Hey @sbarty,

Yes it did 🙂

> [@Iframe for the join link](https://devforum.zoom.us/t/iframe-for-the-join-link/6077/18):
>
> Thanks @tommy! I can confirm embedded Zoom video, audio and screen sharing are now working inside our our meeting app. Rory

Thanks,  
Tommy

[Next page](https://devforum.zoom.us/t/recording-playback-urls-started-returning-x-frame-options-sameorigin-breaking-our-iframe-embedding/6059.md?page=2)
