SSO e-signature - X-frame options to deny - workaround

[marketa_w]

Hi team, we are trying to set up the SSO E-signature for approval but we are facing this error: "Refused to display Refused to display https://login.microsoftonline.com/ in a frame because it set to deny. 

Since this is a Microsoft thing we are not able to set this to another value then the deny, we are thinking  about creating a workaround - ideally:

a) Full-page redirect.  or

b) Popup window.

Does anyone here have any experience with this please?

Thank you.

Best Regards,

Markéta 

[Sreeram Nair]

This error occurs because Microsoft’s login page explicitly sets the HTTP response header
X-Frame-Options: DENY (or the modern equivalent Content-Security-Policy: frame-ancestors 'none').

That header instructs the browser not to load the page inside an iframe for security reasons — preventing clickjacking and other embedding attacks.
Since ServiceNow’s E-Signature (SSO) approval feature by default tries to load the identity-provider login page inside an embedded frame within the ServiceNow UI, the browser blocks it.

Full-Page Redirect - The most reliable and secure workaround is to use a full-page redirect instead of loading the Microsoft login page inside an iframe. In this approach, when the user initiates the SSO E-signature approval, they are redirected directly to the Microsoft login page in the main browser window. After completing the authentication process, Microsoft then redirects the user back to ServiceNow with the required authentication response or approval confirmation. This method fully complies with Microsoft’s security policies and avoids the “X-Frame-Options: DENY” restriction, as it doesn’t attempt to embed the login page. Implementation typically involves updating the UI action or script to perform a redirect using window.location.href instead of rendering an embedded frame or modal.

Popup Window - Popup window can be used to keep the approval process within the same ServiceNow session while still respecting Microsoft’s security rules. Instead of an iframe, a small new browser window is opened using window.open() to display the Microsoft login page. Once the user completes authentication, the popup can communicate back to the parent ServiceNow window using window.opener.postMessage() and then close itself automatically. The parent window can then refresh or update the approval status. This option provides a smoother in-context user experience but requires additional client-side scripting to handle message passing and state updates securely.

[marketa_w]

Hello Sreeram,

thank you so much for explaining both of the options. Since we would like to go with the more reliable approach I think the Full-Page redirect will be better, as you mentioned. Do you please know if there exists any documentation on how to implement this? I tried to search through community and snow docs but could not find any guide. 

Thanks a lot!