I have an asp.NET webapp that utilizes the Microsoft Identity platform for authentication. The purpose of the app is the be a hub that displays other web applications– unfortunately, it seems that modern browsers prohibit the use of iframes to prevent click-jacking.

Is it possible to use iframes within a Entra Id web app? If not, is there a suitable replacement?

Chrome gives an error in the console that reads: “Refused to display in a frame because it set ‘X-Frame-Options’ to ‘deny’

I have viewed other questions like the following, but yielded no results:
Azure AD Owin with Iframe solution
Alternative to iFrames with HTML5

The first link suggests “refreshing the ticket” with the OpenIdConnectAuthenticationNotifications.RedirectToIdentityProvider property with the parameter prompt=none.

The second one recommends using <embed></embed> or <object></object>

Edit:

Another article suggested adding the following code to the web.Config file. I saw no changes when added.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

<system.webServer>
  …
  <httpProtocol>
    <customHeaders>
      <add name="X-Frame-Options" value="SAMEORIGIN" />
    </customHeaders>
  </httpProtocol>
  …
</system.webServer>