Embedded Signing Frame Fails to Load Due to CSP / Frame-Ancestors Issue (Works Only With Third-Party Cookies Blocked)

Question

Hi everyone,We’re experiencing an issue with the embedded signing flow that recently started occurring (it was working fine until last week).We’re following the official guide for creating a focused signing view:👉 https://developers.docusign.com/docs/esign-rest-api/how-to/request-signature-focused-view/Our backend uses docusign-esign@^8.5.0 to generate the signing URL.We include the following domains in our FRAME_ANCESTORS directive:https://our-domain.com https://demo.docusign.net https://apps-d.docusign.com The generated signing URL opens correctly in a separate browser tab.However, when embedding it inside an <iframe>, the frame fails to load and the browser shows a CSP violation error:Content Security Policy of your site blocks some resources Some resources are blocked because their origin is not listed in your site's CSP. ... Resource Status Directive Source location https://apps.dev.docusign.net/.../1ds-bundle.js.map blocked connect-src (unknown) https://apps-d.docusign.com/ blocked frame-ancestors (unknown) If we open the same page in Incognito mode with third-party cookies blocked, the frame loads and works correctly.This issue started happening around last week, without any changes on our side.Has anyone else encountered this behavior or knows if there were any recent changes in DocuSign’s embedded signing CSP or cookie handling?Thanks in advance!

Islam.Hassanein · Accepted Answer

Hi​@TechCP,Could you please remove this domain “https://demo.docusign.net” and test again to see if the issue persists?

TechCP · Answer

Hi​@TechCP,Could you please remove this domain “https://demo.docusign.net” and test again to see if the issue persists?Hi ​@Islam.Hassanein,Thank you so much for your quick reply and help!Removing https://demo.docusign.net from the FRAME_ANCESTORS directive solved the issue — the embedded signing frame now loads and works correctly.We still see several CSP-related console errors when the frame loads pointing to resources likehttps://apps.dev.docusign.net/cdn/integration/1ds/widgets/@ds/signing/25.11.33-1/js/wootricsdk.js.map,but they don’t seem to affect the signing functionality.It looks like we were looking for a more complex cause, but in the end, it was just our own oversight.Really appreciate your help!

Sign up

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.

Docusign Community

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.

Scanning file for viruses.

This file cannot be downloaded