# How to configure CSP frame-ancestors directive for authorize endpoint

**URL:** <https://devforum.okta.com/t/how-to-configure-csp-frame-ancestors-directive-for-authorize-endpoint/27030>\
**Category:** OAuth/OIDC\
**Created:** [February 27, 2024, 5:44pm UTC](https://devforum.okta.com/t/how-to-configure-csp-frame-ancestors-directive-for-authorize-endpoint/27030 "2024-02-27T17:44:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mliu-st](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mliu-st](https://devforum.okta.com/u/mliu-st)\
**Post date:** [February 27, 2024, 5:44pm UTC](https://devforum.okta.com/t/how-to-configure-csp-frame-ancestors-directive-for-authorize-endpoint/27030/1 "2024-02-27T17:44:46Z")

</div>

The Okta Sign-In Widget on my site recently stopped working, with the following error reported in the Developer Tools console:

> Refused to frame ‘[https://myapp.com/](https://myapp.com/)’ because an ancestor violates the following Content Security Policy directive: “frame-ancestors ‘self’”.

In the list of network requests, I see that /oauth2/default/v1/authorize returns the following Content-Security-Policy response header: `...; frame-ancestors 'self'`

**How do I add a `frame-ancestors` origin to this response header?** In Okta Admin Console, I tried going to Security \> API \> Trusted Origins and selecting the “iFrame origin” check box for my origin, but the following warning appears, and indeed the check box has no effect:

> The /authorize endpoint won’t treat this URL as a trusted origin. Validate your CSP headers in report-only mode to prevent errors.

---

<div class="post-metadata">

**Author:** ![dawoudt](https://avatars.discourse-cdn.com/v4/letter/d/ecb155/32.png) [@dawoudt](https://devforum.okta.com/u/dawoudt)\
**Post date:** [February 29, 2024, 3:49am UTC](https://devforum.okta.com/t/how-to-configure-csp-frame-ancestors-directive-for-authorize-endpoint/27030/2 "2024-02-29T03:49:53Z")

</div>

Hey there @mliu-st I think this doc might help [Trusted Origins for iFrame embedding | Okta](https://help.okta.com/oie/en-us/content/topics/api/trusted-origins-iframe.htm)

---

<div class="post-metadata">

**Author:** ![mliu-st](https://avatars.discourse-cdn.com/v4/letter/m/c6cbf5/32.png) [@mliu-st](https://devforum.okta.com/u/mliu-st)\
**Post date:** [February 29, 2024, 5:27pm UTC](https://devforum.okta.com/t/how-to-configure-csp-frame-ancestors-directive-for-authorize-endpoint/27030/3 "2024-02-29T17:27:50Z")

</div>

The " Trusted Origins for iFrame embedding" doc doesn’t appear to explain how to configure the `frame-ancestors` directive for the /authorize endpoint. As I said in my question, the “iFrame origin” check box (mentioned in that doc) has no effect on this endpoint.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [March 30, 2024, 5:28pm UTC](https://devforum.okta.com/t/how-to-configure-csp-frame-ancestors-directive-for-authorize-endpoint/27030/4 "2024-03-30T17:28:42Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.