# Can't use 2FA login in an iframe

**URL:** <https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279>\
**Category:** Get Help\
**Created:** [September 23, 2019, 1:07pm UTC](https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279 "2019-09-23T13:07:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![davestewart](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davestewart/32/13678_2.png) [@davestewart](https://community.auth0.com/u/davestewart)\
**Post date:** [September 23, 2019, 1:07pm UTC](https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279/1 "2019-09-23T13:07:21Z")

</div>

We are using an iframe to allow the user to re-authenticate without leaving our SPA, which worked well with the old authorisation page, but the 2FA shows blank with the following error:

> Refused to display ‘https://[our-domain].eu.auth0.com/u/login?state=g6Fo2SBrUlE0bzNCSFZDZWpHRDhvSW9xZndnNENlVlB5TGhkeKN0aWTZIFRQOTJsNlJCQWRoSkVCV3BKcS1sYlpJcHJTMnptRk5yo2NpZNkgcjdWVm8zNHdiakxDZTQ1bDJacFA5Y0lyQURMazNkZ0I’ in a frame because an ancestor violates the following Content Security Policy directive: “frame-ancestors ‘none’”.

Is there any way round this?

---

<div class="post-metadata">

**Author:** ![jerry.job](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jerry.job/32/12681_2.png) [@jerry.job](https://community.auth0.com/u/jerry.job)\
**Post date:** [November 18, 2019, 8:00am UTC](https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279/2 "2019-11-18T08:00:28Z")

</div>

I guess below is the answer?

> [@Can't use 2FA login in an iframe](http://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279):
>
> We are using an iframe to allow the user to re-authenticate without leaving our SPA, which worked well with the old authorisation page, but the 2FA shows blank with the following error: Refused to display ‘https://[our-domain].eu.auth0.com/u/login?state=g6Fo2SBrUlE0bzNCSFZDZWpHRDhvSW9xZndnNENlVlB5TGhkeKN0aWTZIFRQOTJsNlJCQWRoSkVCV3BKcS1sYlpJcHJTMnptRk5yo2NpZNkgcjdWVm8zNHdiakxDZTQ1bDJacFA5Y0lyQURMazNkZ0I’ in a frame because an ancestor violates the following Content Security Policy directive: “f…

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [November 18, 2019, 11:36am UTC](https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279/3 "2019-11-18T11:36:06Z")

</div>

Thanks a lot for sharing that with the rest of community @jerry.job!

---

<div class="post-metadata">

**Author:** ![davestewart](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/davestewart/32/13678_2.png) [@davestewart](https://community.auth0.com/u/davestewart)\
**Post date:** [November 19, 2019, 2:59pm UTC](https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279/4 "2019-11-19T14:59:32Z")

</div>

Hi @konrad.sopala and @jerry.job - I’m confused…

…the “solution” above is a link back to this very post - so no solution!

Do you have any perspective on that?

---

<div class="post-metadata">

**Author:** ![ejaimec](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ejaimec/32/16164_2.png) [@ejaimec](https://community.auth0.com/u/ejaimec)\
**Post date:** [October 30, 2020, 3:23pm UTC](https://community.auth0.com/t/cant-use-2fa-login-in-an-iframe/31279/5 "2020-10-30T15:23:04Z")

</div>

What is the answer? How can be the policy modified in Auth0?