question Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options' in Community Central forum

Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Peter8 — Tue, 24 Feb 2026 07:59:25 GMT

Hi all, I have create custom widget, embed 3rd website, but it show some error message, how can I resolved it?

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Ankur Bawiskar — Tue, 24 Feb 2026 08:41:36 GMT

you can't embed external website within ServiceNow due to security reason and external website wants to avoid clickjacking attack.

Reason being that external website must be sending an "X-Frame-Options: SAMEORIGIN" or "X-Frame-Options: DENY" in response header.

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Tanushree Maiti — Tue, 24 Feb 2026 09:05:38 GMT

Hi @Peter8 :

You are encountering the error for clickjacking prevention from external site where the external website explicitly blocks other sites from embedding it in an iframe for security reasons.

Here Solution could be

Using Popup window: Open the external link in a new, small browser window using window.open()

OR

Contact the External Website Owner: The most direct solution is to contact the administrator of https://xxxx.com/ and request that they configure their server to allow framing from your ServiceNow domain. This often involves adding a Content-Security-Policy (CSP) frame-ancestors directive or an X-Frame-Options: ALLOW-FROM header specifying your instance's URL.

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Peter8 — Tue, 24 Feb 2026 09:43:07 GMT

Hi @Tanushree Maiti ,

Do you know how can I add this in servicenow instance, for example, I want to embed Prod to DEV, how can I add this policy in Prod instance?

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Peter8 — Tue, 24 Feb 2026 09:45:16 GMT

Hi @Ankur Bawiskar ,

Do you know if there is a way for me to obtain the access token and refresh token after logging in through AAD SSO?

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Ankur Bawiskar — Tue, 24 Feb 2026 09:47:35 GMT

@Peter8

what's your exact requirement?

which external website is this?

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Tanushree Maiti — Tue, 24 Feb 2026 09:52:52 GMT

Share your widget details where you have mentioned the 3rd party site

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Peter8 — Tue, 24 Feb 2026 09:57:42 GMT

Hi @Ankur Bawiskar ,

I want to integrate a third-party website into SNOW. If a user of this system logs in via SSO and then accesses this page, we will find that since they have already logged in, there is no need for manual login. The SSO information will automatically log them in.

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Ankur Bawiskar — Tue, 24 Feb 2026 09:58:56 GMT

@Peter8

is ServiceNow instance also using same SSO as that used by 3rd party website?

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Peter8 — Tue, 24 Feb 2026 10:02:37 GMT

Hi @Tanushree Maiti ,

Currently, I have embedded the ServiceNow Prod environment in the ServiceNow Dev environment, and then displayed this error. How can I add policies and hear in the Prod instance?

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Peter8 — Tue, 24 Feb 2026 10:04:28 GMT

Hi @Ankur Bawiskar ,

Yes, they are same SSO

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Ankur Bawiskar — Tue, 24 Feb 2026 10:16:19 GMT

@Peter8

I still believe that external website/application won't allow this since you are reaching/connecting to their URL from within ServiceNow

Please check with that team if it's allowed or not.

if not then it's not feasible to achieve and embed their URL within ServiceNow.

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

Re: Refused to display 'https://xxxx.com/' in a frame because it set 'X-Frame-Options'

Ankur Bawiskar — Wed, 25 Feb 2026 03:15:51 GMT

@Peter8

Hope you are doing good.

Did my reply answer your question?

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏