IdentityServer4 - Loading login page in iframe

Question

I need to change CSP in response that contains login page from IdentityServer4 in order to render that page in iframe in my client app. Is it possible?

Answer 1

Here you can find a sample MVC application where we have implemented a login mechanism to an IdentityServer4 instance using the authorization code flow but using an iframe. The flow is not that different from redirecting to the authority. Using an iframe just hides the redirection from the user which some believe provides a better user experience.

Regarding IdentityServer4 you need to add the this directive to the CSP. Also it would be good to configure your IS4 not to display a logout prompt, so you can have a seamless logout experience.