Embeddable on any site

Framing rules

• X-Frame-Options: *absent

  Browsers do not know this value, so it has no effect.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 10warning

  5 of 10 cookies do not go into a cross-site frame (X-MR-Browser-ID, channel, guest, openBoardId, isWelcomeNeeded): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: a579ac25b985ddf0-CMH
connection: close
content-security-policy: default-src 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about: miroapp: wss: ws: *; frame-src 'unsafe-inline' 'unsafe-eval' data: blob: miroapp: *; base-uri 'unsafe-inline' about: data: *; form-action 'unsafe-inline' data: post-it-alpha: post-it: com.mmm.postit.miro: *; worker-src 'unsafe-inline' data: blob: miroapp: *; report-uri https://o881784.ingest.sentry.io/api/4504236954746881/security/?sentry_key=d91c0e40f45348d7afe4293693f9474a&sentry_environment=miro-eu;
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy-report-only: credentialless
cross-origin-opener-policy-report-only: same-origin
date: Mon, 09 Nov 2026 03:18:50 GMT
referrer-policy: strict-origin-when-cross-origin
reporting-endpoints: main-endpoint="https://svc.eu01.miro.com/api/web-reporting/public/v1/report/miro_client?clientVersion=1.105917.0", default="https://svc.eu01.miro.com/api/web-reporting/public/v1/report/miro_client?clientVersion=1.105917.0"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
transfer-encoding: chunked
vary: accept-encoding
via: 1.1 fa84a65a8524de3d36ea32628a227200.cloudfront.net (CloudFront)
x-amz-cf-id: D3suE9TiiHdjtfeHFZ0zLc1eLGtMUHf7jNzZgmqMZxkQFhBJoFs44g==
x-amz-cf-pop: CMH68-P2
x-app-renderer-version: 2026.1106.93831-7cb700
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-envoy-upstream-service-time: 31
x-frame-options: *
x-mr-request-id: 262c08c9-c943-431d-ae18-88f7a3e6f3c5
x-xss-protection: 1; mode=block
set-cookie: X-MR-Browser-ID=…; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: ajs_anonymous_id=…; Max-Age=31536000; Domain=.miro.com; Path=/; Expires=Tue, 09 Nov 2027 03:18:50 GMT; Secure; SameSite=None
set-cookie: mr-anon-id-1=…; Max-Age=31536000; Domain=.miro.com; Path=/; Expires=Tue, 09 Nov 2027 03:18:50 GMT; Secure; SameSite=None
set-cookie: userInfo=…; Max-Age=-1; Path=/; Expires=Thu, 23 Apr 1987 00:00:00 GMT; Secure; SameSite=None
set-cookie: clientVersion=…; Max-Age=-1; Path=/; Expires=Thu, 23 Apr 1987 00:00:00 GMT; Secure; SameSite=None
set-cookie: channel=…; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: guest=…; Path=/; Secure; SameSite=Lax
set-cookie: openBoardId=…; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: userCustomRedirect=…; Max-Age=-1; Domain=miro.com; Path=/; Expires=Thu, 23 Apr 1987 00:00:00 GMT; Secure; SameSite=None
set-cookie: isWelcomeNeeded=…; Path=/; Secure; SameSite=Lax

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.