The following error is displayed due to the embedded iframe not being trusted:

Firefox Can’t Open This Page. To protect your security, {domain}.okta.com will not allow Firefox to display the page if another site has embedded it. To see this page, you need to open it in a new window.

• iFrame
• Firefox

When the widget is trying to authenticate to Okta from the IFrame, Firefox will throw the specified error.

To resolve this issue, enable iFrame embedding in the Okta Admin Dashboard:

1. From the Okta Admin Dashboard, navigate to Customizations > Other > IFrame Embedding.
2. Select the checkbox Allow IFrame Embedding.
3. Click Save.

For more granular control, disable the iFrame option and then Configure Trusted Origins to allow the specific iframe embed.

Risks of enabling global iFrame embedding:

• Without domain restrictions, malicious sites can embed Okta pages and deceive users into performing unintended actions.
• This setting bypasses the more secure frame-ancestors directive used with Trusted Origins, reducing protection against unauthorized embedding.
• Relying on global embedding may lead to unpredictable behavior across browsers, impacting both usability and security.

Related References

• Okta Identity Engine (OIE): Okta Trusted Origins for iFrame embedding
• Okta Classic Engine: Okta Trusted Origins for iFrame embedding Classic