OAuth not working inside an iframe

html api iframe oauth foursquare
Jesse Hattabaugh picture Jesse Hattabaugh · Jan 31, 2012 · Viewed 16.3k times · Source

I have built a Fiddle on JSFiddle which retrieves an OAuth access token via Foursquare's "token" response type. One or two days ago this was working fine. When "Login with Foursquare" was clicked Foursquare's authorization page appeared and I was able to get an access_token. Today I get an error that says "Refused to display document because display forbidden by X-Frame-Options." I have contacted JSFiddle to see if they have changed their X-Frame-Options headers, but I believe it is the iframed page that specifies that header. What is Foursquare's policy about OAuth inside iframes and has it changed recently?

Here is my Fiddle

Answer

akdotcom picture akdotcom · Feb 1, 2012

We, at Foursquare, have updated our OAuth flow to not support embedding in iFrames. This is recommended by the OAuth 2 spec.

Related questions

Allow Access-Control-Allow-Origin header using HTML5 fetch API

I am using HTML5 fetch API. var request = new Request('https://davidwalsh.name/demo/arsenal.json'); fetch(request).then(function(response) { // Convert to JSON return response.json(); }).then(function(j) { // Yay, `j` is a JavaScript object console.log(JSON.stringify(…

Read More
fb:like-box, custom css?

Is it possible to add a custom css file to a fb:like-box? For example, I would like to remove the borders around the iframe. Thanks

Read More
Full screen api HTML5 and Safari (iOS 6)

I'm trying to make an application to run in full screen mode (without the top bar) in Safari for iOS 6. The code is as follows: var elem = document.getElementById("element_id"); if (elem.requestFullScreen) { elem.requestFullScreen(); } else if (elem.mozRequestFullScreen) { …

Read More