Self-hosted Cap Web doesn't support embeds

[Exerra]

Description

When using a self-hosted instance of Cap Web the embeds don't work.

There are two issues that make the embeds not work:

1. The embed code generated in the website points to the cap.so instance rather than the self-hosted instance.
2. Even when changing the domain manually to point to the self-hosted instance the embed pages just don't exist.

Reproduction

Incorrect embed code

On a self-hosted instance:

1. Go to a recording
2. Click the share button
3. Navigate to the embed tab and look at the iframe src attribute in the generated embed code.

Embed pages not existing

On a self-hosted instance:

1. Go to a recording
2. Click the share button
3. Navigate to the embed tab and copy the URL in the iframe src attribute
4. Change the cap.so domain in the URL to the self-hosted instances domain
5. Navigate to the modified domain in the browser

Instead of getting the embed page, you will be redirected to the dashboard.

Additional Context

• Cap version: cap-web:latest
• Operating system, version: Docker

[linear]

CAP-448 Self-hosted Cap Web doesn't support embeds

[pievalentin]

Same issue with me. It must be hardcoded in the code base

[stefan-47]

Facing the same issue with error in the console stating:
"Framing 'https://nube-cap.up.railway.app/' violates the following Content Security Policy directive: "frame-ancestors https://cap.so". The request has been blocked."

[dandry]

@nube-agency I believe this is because the issue with showing the dashboard in the iframe. If you are not authenticated to your instance it forces /login path, which is protected, per:

Cap/apps/web/middleware.ts

Line 33 in a292974

"frame-ancestors https://cap.so",

.

[stefan-47]

Hi Daniel, I am not sure if I am reading it correctly, but I am trying to embed a public/shared video using embed code As an example: <div style="position: relative; padding-bottom: 56.25%; height: 0;"><iframe src="https://nube-cap.up.railway.app/embed/pyg8sqmtft33amq" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div> I don't see a reason for it to push /login path Best *⎯Stefan Savanović*Founder - nube.agency <https://www.nube.agency/>

…

On Thu, Nov 27, 2025 at 1:40 PM Daniel Andraszewski < ***@***.***> wrote: *dandry* left a comment (CapSoftware/Cap#906) <#906 (comment)> @nube-agency <https://github.com/nube-agency> I believe this is because the issue with showing the dashboard in the iframe. If you are not authenticated to your instance it forces /login path, which is protected, per: https://github.com/CapSoftware/Cap/blob/a292974ed15926ca32fc28622d39de347464c3f0/apps/web/middleware.ts#L33 . — Reply to this email directly, view it on GitHub <#906 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASAGQLP5IEBAYVPEXZ5MKP3363WMJAVCNFSM6AAAAACEHWCRQWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKOBVGY2TKMRWG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[stefan-47]

Hi, any update on this? *⎯Stefan Savanović*Founder - nube.agency <https://www.nube.agency/> On Thu, Nov 27, 2025 at 1:47 PM Stefan Savanović ***@***.***> wrote:

…

Hi Daniel, I am not sure if I am reading it correctly, but I am trying to embed a public/shared video using embed code As an example: <div style="position: relative; padding-bottom: 56.25%; height: 0;"><iframe src="https://nube-cap.up.railway.app/embed/pyg8sqmtft33amq" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div> I don't see a reason for it to push /login path Best *⎯Stefan Savanović*Founder - nube.agency <https://www.nube.agency/> On Thu, Nov 27, 2025 at 1:40 PM Daniel Andraszewski < ***@***.***> wrote: > *dandry* left a comment (CapSoftware/Cap#906) > <#906 (comment)> > > @nube-agency <https://github.com/nube-agency> I believe this is because > the issue with showing the dashboard in the iframe. If you are not > authenticated to your instance it forces /login path, which is > protected, per: > https://github.com/CapSoftware/Cap/blob/a292974ed15926ca32fc28622d39de347464c3f0/apps/web/middleware.ts#L33 > . > > — > Reply to this email directly, view it on GitHub > <#906 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ASAGQLP5IEBAYVPEXZ5MKP3363WMJAVCNFSM6AAAAACEHWCRQWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTKOBVGY2TKMRWG4> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[lucaspeyrin]

I tried to remove the traffic protection by adding this in the docker compose file :

labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.force-iframe.headers.customResponseHeaders.Content-Security-Policy="
      - "traefik.http.middlewares.force-iframe.headers.customResponseHeaders.X-Frame-Options="
      - "traefik.http.routers.cap-custom.rule=Host(`cap.workflows.ac`)"
      - "traefik.http.routers.cap-custom.entrypoints=websecure"
      - "traefik.http.routers.cap-custom.tls.certresolver=letsencrypt"
      - "traefik.http.routers.cap-custom.middlewares=gzip,force-iframe"

It changed the issue, still not getting the embedded video.

[dandry]

I did create a PR with a potential fix, but it has not received any feedback yet.
#1415