# Using an Iframe within the zoom app

**URL:** <https://devforum.zoom.us/t/using-an-iframe-within-the-zoom-app/91996>\
**Category:** Zoom Apps\
**Created:** [July 18, 2023, 1:54pm UTC](https://devforum.zoom.us/t/using-an-iframe-within-the-zoom-app/91996 "2023-07-18T13:54:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![webmoti](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/webmoti/32/49586_2.png) [@webmoti](https://devforum.zoom.us/u/webmoti)\
**Post date:** [July 18, 2023, 1:54pm UTC](https://devforum.zoom.us/t/using-an-iframe-within-the-zoom-app/91996/1 "2023-07-18T13:54:25Z")

</div>

Hello,

I’m currently working on a zoom app that is able to host any website capable of Iframe functionality within the zoom app; as an Iframe. My current issue is that I keep on getting a content restriction message whenever trying to load this iframe with the zoom app hosted. I have set the allow list to the correct web domain along with setting the frame-src to the correct address; all of this with no avail still getting the same CSP restriction with the frame-src routing to “self”.

ERROR:  
208 Refused to frame ‘[https://www.w3schools.com/](https://www.w3schools.com/)’ because it violates the following Content Security Policy directive: “default-src ‘self’”. Note that ‘frame-src’ was not explicitly set, so ‘default-src’ is used as a fallback.

Although the above says I didn’t set the frame-src in my web app there is the proper meta tags doing such.

Thank you for any help in advance!

---

<div class="post-metadata">

**Author:** ![j.schoenemeyer](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@j.schoenemeyer](https://devforum.zoom.us/u/j.schoenemeyer)\
**Post date:** [July 18, 2023, 6:05pm UTC](https://devforum.zoom.us/t/using-an-iframe-within-the-zoom-app/91996/2 "2023-07-18T18:05:25Z")

</div>

the website does not allow embedding in iframe (-\> server setting)

test in MS Edge

 ![iframe](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/8/b/8b0564b2328b87b76bae60bb8f9f8ed37e4fbda1.png)

there is no way to prevent this block on your side
