Preview mode: triggering an external logic (OIDC)

gamadori · August 17, 2026, 10:04am

Hi all,

I’m having some issue triggering an external login to an OIDC while in preview mode.

The provider has the frame-ancestors 'self' policy which blocks the request coming from inside the iframe. Is it possible to add allow-top-navigation-by-user-activation to the preview iframe?

justin-nevitech · August 18, 2026, 10:44am

Hi @gamadori

Welcome to the forum!

Are you not able to authenticate before entering preview mode, would that not work for you?

Justin

gamadori · August 18, 2026, 11:00am

Hi Neville,

Yes I could authenticate before entering preview and we’re are currently using this workaround. I was hoping in a more permanent solution.

justin-nevitech · August 18, 2026, 11:58am

Hi @gamadori

The frame options are hard-coded here:

github.com/umbraco/Umbraco-CMS

src/Umbraco.Web.UI.Client/src/apps/preview/preview.element.ts

c1fa32eed


      
          	override render() {
          		if (!this._previewUrl) return nothing;
          		return html`
          			${when(!this._iframeReady, () => html`<div id="loading"><uui-loader-circle></uui-loader-circle></div>`)}
          			<div id="wrapper" class="fullsize">
          				<div id="container">
          					<iframe
          						src=${this._previewUrl}
          						title="Page preview"
          						@load=${this.#onIFrameLoad}
          						sandbox="allow-scripts allow-same-origin allow-forms"></iframe>
          				</div>
          			</div>
          			<div id="menu">
          				<h4>Preview Mode</h4>
          				<div id="apps">
          					<umb-extension-slot type="previewApp"></umb-extension-slot>
          				</div>
          			</div>
          		`;
          	}

Is that definitely your issue and not something else blocking your auth flow? Do you get any errors or warnings in the console?

Justin

gamadori · August 18, 2026, 1:37pm

Hi Justin,

In the console I see this
Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-ancestors) at because it violates the following directive: “frame-ancestors 'self'”

I’ve done a lot of debugging and from what I’ve discovered the provider block its own login page from being framed by anything other that its own origin.

justin-nevitech · August 18, 2026, 6:51pm

Hi @gamadori

Are you applying your own CSP that could be blocking this?

Justin