Refused to display 'https://auth.web3auth.io/' in a frame because it set 'X-Frame-Options' to 'deny'

Hello! Our app is launched inside an in-app browser (Telegram). Web3auth works great in Telegram app, both desktop and mobile, but Telegram Web version opens it in an iframe, and web3auth throws Refused to display 'https://auth.web3auth.io/' in a frame because it set 'X-Frame-Options' to 'deny' error. Is there any way we can make it work?

When asking for help in this category, please make sure to provide the following details:

Also, kindly provide the Web3Auth initialization and login code snippet below. This will help us better understand your issue and provide you with the necessary assistance.

const web3auth = new Web3AuthNoModal({
  clientId: env.WEB3AUTH_CLIENT_ID,
  web3AuthNetwork: env.WEB3AUTH_NETWORK,
  privateKeyProvider,
  uiConfig: {
    appName: env.WEB3AUTH_UI_APP_NAME,
    mode: "auto",
    useLogoLoader: true,
    logoLight: env.WEB3AUTH_UI_LOGO_LIGHT,
    logoDark: env.WEB3AUTH_UI_LOGO_DARK,
    defaultLanguage: "en",
    theme: {
      primary: env.WEB3AUTH_UI_THEME_PRIMARY,
    },
  },
});

const openloginAdapter = new OpenloginAdapter({
  adapterSettings: {
    uxMode: "redirect",
    replaceUrlOnRedirect: false,
    loginConfig: {
      jwt: {
        typeOfLogin: "jwt",
        clientId: env.WEB3AUTH_CLIENT_ID,
        verifier: env.WEB3AUTH_VERIFIER_ID,
        verifierSubIdentifier: env.WEB3AUTH_VERIFIER_SUB_ID,
      },
    },
    sessionTime: 604800,
    whiteLabel: {
      appName: env.WEB3AUTH_UI_APP_NAME,
    },
  },
  privateKeyProvider,
} satisfies OpenloginAdapterOptions);

web3auth.configureAdapter(openloginAdapter);
1 Like

hi @av1

I hope you are doing well. I will take this question to our team and come back to you.

Please be patience

Thanks

2 Likes

hi @av1

Thanks for your patience. ‘X-Frame-Options’ is set to ‘deny’ for security reasons. You can read more at https://www.imperva.com/learn/application-security/clickjacking/#:~:text=X-Frame-Options%20allows%20content,them%20to%20the%20current%20domain.

@TomTom That’s a very reasonable thing in general! Would it be possible to allow configuration of allowed frame origins on a per-app basis, given that the app runs within a known parent site’s iframe?

Hi @freeatnet,

I hope you are doing great. I’m sorry to inform you that the option is there because of a security reason.

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.