# Disable Clickjacking protection for New Universal Login per application

**URL:** <https://community.auth0.com/t/disable-clickjacking-protection-for-new-universal-login-per-application/168951>\
**Category:** Product Feedback\
**Tags:** clickjack-protection\
**Created:** [January 16, 2025, 9:25pm UTC](https://community.auth0.com/t/disable-clickjacking-protection-for-new-universal-login-per-application/168951 "2025-01-16T21:25:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tiago.rosa](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/tiago.rosa/32/60323_2.png) [@tiago.rosa](https://community.auth0.com/u/tiago.rosa)\
**Post date:** [January 16, 2025, 9:25pm UTC](https://community.auth0.com/t/disable-clickjacking-protection-for-new-universal-login-per-application/168951/1 "2025-01-16T21:25:30Z")

</div>

**Feature:** Per-Application Clickjacking Protection Configuration for Classic and New Universal Login

**Description:** Currently, the New Universal Login enforces clickjacking protection by default, with no option to configure it per application. This limitation prevents whitelisting specific domains for iframe embedding and blocking the usage of the New Universal Login. A feature to configure clickjacking protection per application would allow specifying whitelisted domains in the Content Security Policy (CSP) header. While the Classic Login allows disabling this protection, it applies at the tenant level, leaving all applications vulnerable across any domain.

**Use-case:** This feature would enable secure embedding of applications in iframes on specific external domains without compromising the security of other applications. For example, it would support scenarios where an application must be embedded in a trusted partner’s website while maintaining clickjacking protection for other applications.

---

<div class="post-metadata">

**Author:** ![marybeth.hunter](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marybeth.hunter/32/61955_2.png) [@marybeth.hunter](https://community.auth0.com/u/marybeth.hunter)\
**Post date:** [January 16, 2025, 11:17pm UTC](https://community.auth0.com/t/disable-clickjacking-protection-for-new-universal-login-per-application/168951/2 "2025-01-16T23:17:19Z")

</div>

Hi @tiago.rosa,

Thanks for the feedback!

Best,

Mary Beth