Skip to content
iframecheck

Login loop in an iframe: the sign-in page loads again

You sign in inside the frame, and the sign-in page comes back. The login worked, but the browser does not send the session cookie to the framed site, so each request looks signed out.

  • Chrome
  • Edge
  • Firefox
  • Safari

Updated

What you see · All browsers, our words

The sign-in page loads again inside the frame after you sign in.

Chrome, EdgeWhat you see

The sign-in page loads again. DevTools shows a blocked cookie in the Issues tab or on the Cookies tab of the request.

FirefoxWhat you see

The sign-in page loads again. The console often has a line that starts with “Cookie” and says it was rejected.

SafariWhat you see

The sign-in page loads again. Safari blocks the cookies of a site in a frame unless the site gets storage access.

On this page

What it means

The sign-in worked, but the next request from the frame does not carry the session cookie. The server sees a user who is not signed in and shows the sign-in page again. There is often no error message, only the loop. Read about cookies in iframes.

Why it happens

A frame from another site is a third-party context. The session cookie of the framed site does not get there:

  1. A cookie with SameSite=Lax (the default in Chrome and Edge) or SameSite=Strict is not sent to a site in a frame from another site.

  2. Safari blocks third-party cookies by default. Firefox keeps a separate cookie jar for each top site.

  3. Chrome blocks third-party cookies in Incognito and when the user turns that setting on.

  4. Many sign-in pages also open a pop-up or move the top page, which a sandboxed frame cannot do.

Check the page

See the headers the page sends now

Fix it if you own the site

Set the session cookie with SameSite=None; Secure; Partitioned. If the frame must use the cookies it has as a first-party site, call document.requestStorageAccess() after a click. The login guide has the details.

Response header
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None; Partitioned

A cookie with SameSite=None must also have Secure, and the page must use HTTPS. Without Secure, the browser rejects the cookie.

If you do not own the site

You cannot change the cookies of another site. Use one of these.

  1. Open the page in a new tab

    Link to the page so the user signs in on the site itself, where its cookies work.

  2. Use the official embed

    Some services give an embed that needs no login, or one that is made for frames.

  3. Ask the owner

    Ask them to set their cookie with SameSite=None, Secure and Partitioned.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides