I am getting "403 Forbidden, domain or scheme is not allowed: a localhost domain
when trying to use this url in an iframe under a different domain.
Is this allowed? Are there any other well know restrictions to using an iframe?
I am not even seeing the iframe’d domain be hit. If I switch the top level domain to the same domain it seems to work. I have setup OSWAP headers and am no longer seeing OSWAP related errors and if I change them to not include that domain I see a different OSWAP error.
I have added the domain to the allowlist.