Trouble embedding my retool app into an iframe

App Building
1

I am currently loading my retool app in my react app through an iframe like this

 <iframe
        src="https://assured.retool.com/apps/AppName"
        width="100%"
        height="800px"
      ></iframe>

After I do this it wants me to login.
However when I login via sign in with gmail it gives me this err from the console:

retool-edge.com/app.8a85efbacfe2bf1c2027.js:1 [Service Worker]
 TypeError: Failed to register a ServiceWorker for scope ('https://login.retool.com/')
with script ('https://login.retool.com/sw.js'): 
A bad HTTP response code (404) was received when fetching the script.

It also gives me this error saying refused to display ‘url’ in a frame because it set ‘X-Frame-Options’ to ‘deny’.

I checked the headers from where this was coming from and it says I have 302 error. I checked the location and request url via my browser and it seemed to work fine, so I am confused on why this error appeared.

I feel like these are the errors that are preventing me from logging in, but I wouldn’t know how to resolve them.

1 Like
2

Did you solve it? I have the same error.

3

@rjvarona @Grabriela

The refused to display ‘url’ in a frame because it set ‘X-Frame-Options’ to ‘deny’ error might be tough to overcome here. Google sets the X-Frame-Options to Deny, which doesn’t allow the page to be embedded in a domain outside of their own (see https://stackoverflow.com/questions/27358966/how-to-set-x-frame-options-on-iframe). So you’ll likely need to get quite creative in order to make an Google OAuth request from an iFrame.

4

Our team has this same error - are there any updates on proposed solutions?

5

Hi @jschwane

As Ben mentioned, this is a bit tricky to workaround. Googles impose a restrictions that does not allow for their domain to be embedded in iframes, which is needed if using Google SSO for authentication to a Retool app. If a user has an active Retool session the embedded app should display as expected, but will require Google SSO authentication outside the iframe. Other options around this limitation of Google SSO would be to establish other forms of authentication like email/password, or for self-hosted instances, SAML.

1 Like