Auth0 with Cypress gives Content Security Policy directive: "frame-ancestors 'none'"

Viewed 503

I have been trying to run Cypress with an implementation of Auth0 in our website. I have tried tons of things out that the Auth0 community has already provided but nothing seems to work.

Here is the problem: When I visit my url endpoint, it redirects me to the Auth0 login page. There I can add my username and password to login. When I do this manually its not a problem but when I do this with cy.get or cy.visit, I get the following error:

Refused to frame 'auth0tenant.auth0.com' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'none'".

I have tried adding the following headers to my request:

X-Frame-Options: deny
Content-Security-Policy: frame-ancestors 'none'

This does not work.

Following this blog that Auth0 has for Cypress does not work either.

I have also set clickjacking to ON in my Auth0 tenant settings. That did not do the job either.

I have also tried setting the cookies in my local storage just the way it sets in my browser but that doesn't work either. Basically I get the jwt token and I decode it and add the values of audience and domain to the local storage in my browser. But the browser itself is failing to load because of the CSP error which I have not been able to fix.

Any help in the area would be highly appreciated. Thank you!

2 Answers

The "New" login page always drops the Content Secuirty Policy and X-frame: deny headers

Switch back to the "classic"

Related