authentication - How to authenticate inside an iframe when it is blocked by X-Frame-Options

Question

I am working with an application where another application is embedded inside an iframe.

The embedded application uses a google service which requires authentication.

Of course Google is not happy about this

Refused to display 'https://accounts.google.com/signin/oauth/error?authError=[...characters...].apps.googleusercontent.com' in a frame because it set 'X-Frame-Options' to 'deny'

Is there any alternative for authenticating and connecting to this service within the iframe?

Answer 1

If X-Frame-Options is set to DENY then supporting browsers will refuse to display the site in an iframe regardless of site settings or domain.

This behavior is intended to prevent clickjacking attacks.

If you have control over the browser your users are utilizing, you can select a browser that does not support X-Frame-Options.