# Refused to display 'https://auth.priz.guru/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

**URL:** <https://community.auth0.com/t/refused-to-display-https-auth-priz-guru-in-a-frame-because-it-set-x-frame-options-to-sameorigin/195103>\
**Category:** Get Help\
**Tags:** authentication-sessions, sessions\
**Created:** [December 2, 2025, 4:03am UTC](https://community.auth0.com/t/refused-to-display-https-auth-priz-guru-in-a-frame-because-it-set-x-frame-options-to-sameorigin/195103 "2025-12-02T04:03:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shurika](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/shurika/32/17760_2.png) [@shurika](https://community.auth0.com/u/shurika)\
**Post date:** [December 2, 2025, 4:03am UTC](https://community.auth0.com/t/refused-to-display-https-auth-priz-guru-in-a-frame-because-it-set-x-frame-options-to-sameorigin/195103/1 "2025-12-02T04:03:09Z")

</div>

Hi all,

We have been using the custom login pages through Auth0 for a while now; however, lately, the token renewal has started failing.

What we should uncover is that most likely our Content-Security-policy was not set correctly.

After fixing it, so there are no errors or even warnings, we are now getting a different error.

`Timeout during executing web_message communication`

We are using `WebAuth` as our integration library, and it looks something like this:

```typescript
auth0Instance = new WebAuth({
      audience: 'https://priz-guru.auth0.com/api/v2/',    
      clientID: ' **********************',    
      domain: 'auth.priz.guru',    
      responseType: 'token id_token',    
      scope: 'openid email profile offline_access',    
      overrides: {      
          __tenant: 'priz-guru',      
          __token_issuer: 'https://auth.priz.guru/',    
      },
      leeway: 300,
    });

```

The login works ok; however, we are still failing to refresh the token with the following error.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/8/b/8bde6c97f5b88d54e19c74964d52cbd243c13aa8.jpeg)

One thing that we have now noticed is that right after we redirected back to the callback (from auth0), we are getting the following error:

 ![image](https://global.discourse-cdn.com/auth0/original/3X/4/7/4766e0037fbf6853d20faf55e68aa4e7e9cda08c.png)

If I understand correctly, the reason for this is that Auth0 is not allowed to show our domain in an iframe.

We have a custom domain setup (auth.priz.guru).

Note: Following these docs for guidance:  
[https://auth0.com/docs/customize/custom-domains](https://auth0.com/docs/customize/custom-domains)

[https://auth0.com/docs/customize/custom-domains/configure-features-to-use-custom-domains#universal-login](https://auth0.com/docs/customize/custom-domains/configure-features-to-use-custom-domains#universal-login)

I feel like it is something related to a misconfigured tenant and issuer, but I am not sure what.

---

<div class="post-metadata">

**Author:** ![shurika](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/shurika/32/17760_2.png) [@shurika](https://community.auth0.com/u/shurika)\
**Post date:** [December 2, 2025, 4:57am UTC](https://community.auth0.com/t/refused-to-display-https-auth-priz-guru-in-a-frame-because-it-set-x-frame-options-to-sameorigin/195103/2 "2025-12-02T04:57:03Z")

</div>

Not 100% sure yet, but I think I just figured it out.  
I had additional security headers enabled in Cloudflare: [Available Managed Transforms · Cloudflare Rules docs](https://developers.cloudflare.com/rules/transform/managed-transforms/reference/#add-security-headers)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 16, 2025, 4:57am UTC](https://community.auth0.com/t/refused-to-display-https-auth-priz-guru-in-a-frame-because-it-set-x-frame-options-to-sameorigin/195103/3 "2025-12-16T04:57:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.