This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 33%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWS%3C/text%3E%3C/svg%3E)
When I try to run a SharePoint page that is not published and need authentication in the iframe it asks for username and password while the SharePoint page which is published and has anonymous access not asks for a username and password in Iframe.
Is there is a way so that Iframe blocks both published and authenticated SharePoint pages when call in IFrame?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(252.8, 5%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Hi @Web/SharePoint Full Stack ,
As far as I know ,there is no such way to block authenticated sharepoint pages. Authenticated SharePoint pages mean we need permission to connect to the page. So when we log in. The authentication is necessary. If you want to skip authentication , can only set anonymous access or publish.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
hi @RaytheonXie_MSFT ,
You are right authenticated means username and password but asking for credentials from within iframe source comes under vulnerability actually I did Penetration Testing of my web application from a third-party vendor and they highlighted this issue according to them An attacker can use the web app in a malicious frame that might mislead the user & can plan further attacks.
My point is page should be blocked in an iframe if the X Frame header on the web application in SharePoint is by default set to the same origin due to which published pages are blocked in an iframe if calling from another domain, but with authenticated pages, it is asking username and password.