Content Security Policy Error During iframe Login

This article explains the cause of the following error whenever a user attempts to log in through the iframe:

Refused to frame 'https://auth0domain/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'"

• Classic Universal Login
• iframe

See the Clickjacking Protection for Universal Login Change document for a full explanation of this error.

If the toggle is enabled, additional HTTP security headers will not be included in the response to prevent embedding of the Universal Login prompts in an iframe.

This can be changed as well via the management API to enable this flag for the tenant by performing a request like the following: 

PATCH https://your_auth0_domain/api/v2/tenants/settings
{
     “flags”: {
        “disable_clickjack_protection_headers”: true
    }
}

See Update tenant settings for more details.

NOTE: To be able to patch the tenant settings, the token needs to have the update:tenant_settings permission.