Authentication loop: Blocked script execution in <URL> because the document's frame is sandboxed ...

Shopify Apps
,

Topic summary

Users are experiencing an authentication loop issue when loading a Shopify app. The browser console shows thousands of repeated requests and errors stating: “Blocked script execution in ‘’ because the document’s frame is sandboxed and the ‘allow-scripts’ permission is not set.”

Key Details:

  • The issue occurs in both Chrome and Safari browsers
  • Safari specifically returns a 403 error when attempting to access Google authentication endpoints (accounts.google.com)
  • JavaScript execution is being blocked due to missing or incorrectly configured sandbox permissions

Current Status:

  • The original poster has checked their configuration but cannot identify the root cause
  • Multiple users have confirmed experiencing the same problem
  • No solution or workaround has been provided yet
  • The discussion remains open with users seeking guidance on properly configuring the ‘allow-scripts’ permission in the sandbox settings
Summarized with AI on October 29. AI used: claude-sonnet-4-5-20250929.
1

Hi there,

I’m encountering an issue with blocked script execution in a specific URL. There are plenty of users with the same issues, I’m hoping to get more assistance.

When loading the application, the front end loops with thousands of requests and errors. The error message reads: “Blocked script execution in ‘’ because the document’s frame is sandboxed and the ‘allow-scripts’ permission is not set.”

It seems that the document’s frame is sandboxed, but the ‘allow-scripts’ permission is missing or not set correctly. As a result, JavaScript execution is being blocked, causing functionality issues on the page.

This happens on both chrome and safari.

Additionally, specifically in Safari I’m getting 403 error for:

https://accounts.google.com/v3/signin/identifier?opparams=%253Fcred_ref%253Dtrue&dsh=S1577211400%3A1725797834778693&client_id=574667250608-c4amu90e7stvvubvd4q2g0m1t55g072d.apps.googleusercontent.com&code_challenge=6d2jZ9TUM70V1KqV0tsjPoSKLXosT7Rc5VQ5lYNQ2mU&code_challenge_method=S256&ddm=0&o2v=2&redirect_uri=https%3A%2F%2Fiap.googleapis.com%2Fv1%2Foauth%2FclientIds%2F574667250608-c4amu90e7stvvubvd4q2g0m1t55g072d.apps.googleusercontent.com%3AhandleRedirect&response_type=code&scope=openid+email&service=lso&state=AWV8jjgEeQu …

I’ve already checked the configuration, but I’m unable to identify the root cause of the problem. Could someone provide guidance on how to properly set the ‘allow-scripts’ permission in the sandbox configuration?

Any insights or suggestions would be greatly appreciated.

1 Like
2

bumping for attention, I’ve been dealing with this for way too long

1 Like
3

Would like some insight here as well.

4

Any leads on this??