Blocked script execution in '<URL>' because the document's frame is sandboxed and the 'allow-scripts

[1080]

Hi there,

I'm encountering an issue with blocked script execution in a specific URL. The error message reads: "Blocked script execution in '<URL>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set."

It seems that the document's frame is sandboxed, but the 'allow-scripts' permission is missing or not set correctly. As a result, JavaScript execution is being blocked, causing functionality issues on the page.

I've already checked the configuration, but I'm unable to identify the root cause of the problem. Could someone provide guidance on how to properly set the 'allow-scripts' permission in the sandbox configuration?

Any insights or suggestions would be greatly appreciated.

[TarikVelic]

Any answers regarding this?

[DDanielsson]

Im having the same issue, would appreciate if someone could help out!

[BigSkillet]

Having same issue...

[Beckem]

I have same issue

[alifaiz1804]

same issue

[drock111]

same issue here

[shrinerp]

Same here

[precision-track]

I'm also having this issue after updating my libraries, can someone from Shopify check on this? I think many apps are being affected!

[precision-track]

I indeed have found that the block script url is not affecting my React application, so this is maybe not a blocker for apps using React. Also did not affect the AppBridge execution, everything seems to be normal, however is actually annoying having this in your console, I hope this is solved soon.

[skillmatic]

Same here.

[nelsonestrada]

same issue, has anybody figured out how to solve this problem?

[oribenezra]

Same same. waiting for a fix...

[shamimshahchera]

I have the same issue 😞

[sahanrajitha]

Same issue here. Any answer?

[lissamoe]

so they don't offer help this is the only way and then they don't help you. cool.

[sahanrajitha]

Disabling ad blocker extensions on chrome fixed my issue. Hope this will help

[patrickpittman]

Weirdly, adding a Polaris Page component wrapper to my Remix component (so it wasn't starting with just Layout) solved this for me... 

[wappy]

same. app dev been stuck for half a year by now..

[Allan8000]

Any update?

[CodieApps]

Same here

[wappy]

Can you reply with code? been dealing with this for too long

[patrickpittman]

Is your route wrapping its return in a <Page> component? If not, try this. So, <Page><Layout>...</Layout></Page>.

I can't say why this worked for me, perhaps Page is more compulsory than the docs suggest, but it instantly solved the problem for me at least.

[wappy]

Not for me, I'm stuck on this even on the app template.

[patrickpittman]

For me, the stock app template was sporadically giving this issue. I checked all server headers over and over, and all was as it should be. But do check that your entry.server.js is running addDocumentResponseHeaders (it should be by default). Beyond that, who knows!

What's become clear to me porting an app from express over to remix is that it's very much a buggy work in progress with incomplete documentation, and I don't think the Polaris team and the Remix team are entirely aligned on how things work... 

[wappy]

I understand. Unfortunately, entry.server.js has addDocumentResponseHeaders so there's nothing I could change in the current setup.

[Kris_Doyle]

Was this ever resolved? I'm seeing tons of these this too now:

Blocked script execution in '<URL>' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

It's referring to the iframe that contains the app which needs to have allow-scripts but does not.

<iframe sandbox="allow-scripts" src="..."></iframe>

Unless I'm wrong, I don't think there's anything an app can do for that. What's weird is that when I check the source, I don't see a "sandbox" attribute so I'm confused. Anyone?

[ChungXa]

The same to me. This is my first time try to publish my custom app to a store. It's stuck with an error in Console

```Blocked script execution in 'https://<mydomain>/auth/session-token?...' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.```

Looking at the iframe I don't see any sandbox attribute. What could I do to make it work?

[memovillalobos]

One thing I've noticed is that opening the iframe URL in a separate tab or window will make it work and the app will now be displayed, but only for that session so not really a fix. I'm also experiencing this on an app we built and have not been able to fix it or find any useful information.

[yash18]

Anything yet, been having this issue for ages with no help!!

[ChungXa]

Somehow it's working for me now. I don't know but I guess that it could be something related to domains. Maybe we are using a different domain of online store in app config

[yash18]

Can you share the config files and settings, and also that which domain are you talking about the application urls and the redirect urls deployed somewhere or something else?

[VGM137]

Hey everyone having this issue checkout for you environment variables, make sure you have the correct credentials for:
SHOPIFY_API_KEY
SHOPIFY_AUTOCOMPLETE_CHECKOUT_ID
SHOPIFY_MANAGE_CUSTOMER_ADDRESSES_ID
SHOPIFY_PERSONALIZED_CART_ID
DATABASE_URL