API use in iFrame

[Lazarus404]

I'm trying to utilise this as part of an API server. The client accessing this is a SPA. Once I've called GET on the NEW endpoint, I open an IFrame and set its URL to the returned url value. However, after redirecting to https://github.com/login?client_id=..., which has a 200 status code, the IFrame shows github.com refused to connect.

Do you have any idea's? I'm not sure what to look for, since the network tab in Chrome shows everything returning correctly.

[danschultzer]

Iframes should not be permitted for OAuth 2.0 flow: https://tools.ietf.org/html/draft-ietf-oauth-v2-23#section-10.13

I believe Github sets the x-frame-options header to prevent clickjacking. So your only option is to either use the authorization url in the current window, or open a new one.