3788988 - Mashup Shows "Refused to Connect" Due to SSO Redirect

When an external website is embedded in a mashup, the mashup displays the following error instead of the expected content:

"Refused to connect" or "[URL] refused to connect"

This issue occurs when the embedded website requires Single Sign-On (SSO) authentication and redirects the user to an SSO login page.

*Note: A Mashup is essentially an iFrame — they are functionally equivalent.

SAP Sales and Service Cloud Version 2

Most SSO Identity Providers (IdPs) block rendering inside iFrames(Mashups) by setting the HTTP response header:

X-Frame-Options: DENY(or SAMEORIGIN)
Content-Security-Policy: frame-ancestors 'none'(or 'self')

When the iFrame attempts to load the embedded URL:

1. The target website detects the user is not authenticated.
2. It redirects the browser to the SSO login page.
3. The SSO login page has X-Frame-Options: DENY set, blocking iFrame rendering.
4. The browser refuses to display the SSO page inside the iFrame, resulting in the "Refused to connect" error.

This is an intentional security measure by IdPs to prevent clickjacking attacks — the SSO page itself is not broken.

There are three possible approaches to resolve this issue:

Option 1: Pre-authenticate via Browser (Workaround)

Open the embedded website URL directly in a new browser tab and complete the SSO login. Once authenticated, return to the application and refresh — the mashup will load correctly using the established SSO session.

Note: This is a temporary workaround. The session will expire and the step may need to be repeated.

Option 2: Use a Popup Window for SSO Authentication

Modify the application to open a popup window that triggers SSO login before loading the iFrame. Once the user
completes login in the popup, reload the iFrame content programmatically.

Note: Ensure the application domain is allowlisted if browser popup blockers are enabled.

Option 3: Contact the SSO Provider to Allow iFrame Embedding

Request the IdP administrator to update the server's Content-Security-Policy header to allow the application domain as
 a trusted frame ancestor:

Content-Security-Policy: frame-ancestors 'self' https://your-c4c-app-domain.com

Note: This change has security implications. Ensure it is reviewed and approved by the relevant security team before implementation.

iframe, mashup, refused to connect, SSO, single sign-on, X-Frame-Options, Content-Security-Policy , KBA , CEC-CRM-MAS , Mashups for SAP Sales/Service Cloud , Problem

SAP Sales Cloud and SAP Service Cloud Version 2 all versions