X-Frame-Options Issue When Using Sandpack on Custom Domain

[0xlau]

Bug report

Packages affected

• sandpack-client
• sandpack-react

Description of the problem

When deploying a web application that uses Sandpack to a custom domain (in this case, deployed on Vercel), the Sandpack iframe fails to load due to X-Frame-Options restrictions.

Failed to load resource: the server responded with a status of 403 ()

Refused to display 'https://2-19-8-sandpack.codesandbox.io/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Steps to Reproduce

• Create a web application using Sandpack
• Deploy the application to Vercel with a custom domain
• Access the application through the custom domain
• Observe that Sandpack iframe fails to load with X-Frame-Options error

[RND332]

+1

[othorizon]

+1 ！！！！

WHY is this happening?

[bakermanbrian]

+1

[ravindra887]

I'm also facing the same issue with the static tempalte and when i use the default DNS, requests to https://26eda60b196bf60-preview.sandpack-static-server.codesandbox.io/__csb_relay/ returns with a response header x-frame-options: SAMEORIGIN

when i change the DNS server in browser to cloudflare(1.1.1.1) it works just fine.

[stevelewis99]

Seems to coincide with seeing (new?) cloudflare 'verifying you are human' checks when visiting codesandbox.io cc @CompuIves

[ASUHUTOSH]

@ravindra887 , can you please help me with the steps. I am also facing this header issue and not able to proceed at all. Thanks in advance 🙂