iFrame Login with the New Universal Login Fails with Content Security Policy Directive: "frame-ancestors 'none'" During Silent Authentication

When a user logs in to a website with iFrame with the New Universal Login with a social provider (Google), the silent authentication fails with the following error:

Refused to frame 'https://canonical-domain.us.auth0.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'.

• iFrame
• Silent Authentication
• Universal Login

When the iFrame tries to render the login widget because the connection for the rendered application is not enabled, it fails because it can not be rendered on an iFrame.

When a silent authentication request returns an error like login required, the SDK is the one that sends the /authorize request to Auth0, and that is when it tries to render the login page. The error is seen in the browser console when the New Universal Login is used.

The connection for the main application and the application rendered inside the iFrame should be active for both. It can be any connection, database, social, etc.

1. Navigate to Applications.
2. Select the Application.
3. Click Connections.
4. The same connection needs to be active for both applications.