Getting 403 error with _dash-update-component for web app in iframe


Hello, I was hoping someone could shed some light on an error I’m getting when trying to access my dash app via an iframe.

I have a web app hosted by Python Anywhere that’s located here. I temporarily changed it to an example from the dash docs to make sure my other code wasn’t the issue. The only change is that I added the line: server = app.server

So as you’ll see, the app runs just fine. The problem arises when I try to embed it in an iframe. When I load the page with the iframe, most of the web app is loaded. The text and widgets and css styling get loaded, and I can choose different options from the dropdowns and things (or in the case of the example app that’s currently up, I can move the slider around). But the graph (the scatter plot) that should be generated based on the widget options never appears. When I look at my browser’s network monitor, I see that, for instance, the _dash-layout and _dash-dependencies files come through just fine. But the _dash-update-component file gets a 403 error. And every time I change one of the widget options, I get another 403 error for _dash-update-component.

I asked the Python Anywhere folks about this here, and as you’ll see they suggested that “either your web app itself is generating the 403, or the framework you’re using is. It sounds like the page is sending a request and either your code or your framework disallows requests from within an iframe.”

Is this true? I have seen @chriddyp suggest embedding dash apps via iframes in several other places. Is there some change I need to make to the code to allow it to work with iframes?

Any help you can provide is much appreciated. Thanks for your time!


@agstanton - This is likely due to the CSRF protection in Dash. You can disable this with app = dash.Dash(csrf_protect=False) . I’ll likely be removing CSRF protection in the future anyway (see


@chriddyp - That did the trick, thanks very much!

And btw thanks for making Dash, it’s an excellent tool and something I’d been wishing for for quite a while.