Hi @LeoAdamek,
This request is still in our queue. The users that access the embedded app are considered external users, but an external user is priced at the same rate as an end user on the Business plan.
Hi @LeoAdamek,
This request is still in our queue. The users that access the embedded app are considered external users, but an external user is priced at the same rate as an end user on the Business plan.
Hi folks, just wanted to provide more clarification of OAuth within embedded applications. To clarify, this is not a bug!
The OAuth 2.0 spec specifically advises against using OAuth within embedded browsers due to security concerns around clickjacking, which is why certain Identity Providers have clickjacking protection on by default. One of the primary targets of clickjacking attacks is to steal login credentials.
The spec recommends setting headers to deny OAuth inside of an iframe and most Identity Providers like Okta have this on by default.
The workarounds here would be to:
metadata
property (docs here). So if your parent app uses OAuth when the user is logging in, you could pass in the OAuth token into metadata
and it will be stored on the current_user
object in the application. From there, that OAuth token can be referenced in subsequent requests made to the customer's Resources.