Embedding bokeh server not working

I have a bokeh server running and trying to embed it within django.

What I understand from the documentation is that the html source code with the script tag is as it is supposed to be.
But the script tag does not embed the bokeh server while the iframe does work.

what is wrong with the script tag??

the html source code looks like this:

    <script type="text/javascript" src="http://cdn.bokeh.org/bokeh/release/bokeh-1.4.0.min.js"></script>
    <script type="text/javascript" src="http://cdn.bokeh.org/bokeh/release/bokeh-api-1.4.0.min.js"></script>


    <title>Bokeh Server via Django</title>
</head>

<body>
    <div>
        <hr>
        <a href="/sliders/">sliders</a>
        <a href="/histogram/">selection histogram</a>
        <hr>
    </div>
    <main>
        
<div>
    
</div>
  <h3>Sliders</h3>
  
   <script src="http://localhost:5006/sliders/autoload.js?bokeh-autoload-element=1490&bokeh-app-path=/sliders&bokeh-absolute-url=http://localhost:5006/sliders&bokeh-session-id=2hbbtb65DBSQ9UYu9UbnEdRmUCLJBSeJdVIah78jwc0j" id="1490"></script>

  <iframe src=http://localhost:5006/sliders width="1080", height="1080" style="border:none"></iframe>

    </main>
</body>

Are there any errors in the brower’s JS console, or the bokeh server console logs? There is not enough information here to speculate.

I found that a had to add --allow-websocket-origin=127.0.0.1:8000 when starting the bokeh server. After doing that it worked.

Yes, absolutely. If you want to embed a Bokeh server application in a remote page, the Bokeh server has to have been explicitly told what the origin of that page is, to allow it. This is a security measure to ensure that your Bokeh app is limited to only be embeddable on origins that you specify, and not on simply any and every page created by any random person on the internet. ^[1]

1. It would be great it if websockets had a standard, common, documented CORS mechanism just the same way HTTP requests has a set of standard headers that everyone can learn about. But that’s not the case, so we had to invent the wheel. ↩︎