Users are unable to authenticate when accessing an application embedded in an iFrame. This issue occurs when the Enforce device matching for creating sessions feature is enabled.

The users may see a 403 forbidden error returned by Okta:

• Enforce device matching for creating sessions

The browser blocks third-party cookies, which prevents the Device Token (DT) cookie from being passed correctly within the iFrame. The Enforce device matching for creating sessions feature relies on this cookie to validate the device identifier. When the cookie is blocked, the validation fails.

To resolve this issue, either:

1. Enable third-party cookies in the browser settings.
2. Disable enforce device matching for creating sessions.