--- schema_version: "1" id: 09fc894f6c6127fa9c340f8efcf025ad085904f8c0cf1470f912ac8febf5c300 title: Embedded Login Considerations collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_identity_login_considerations.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_considerations.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 69de3366c5275e4909049716d04b5024e188bf5dbd84f060d8dd794f0f0711e1 description: When implementing Embedded Login, be aware of these considerations. products: - Security - Cross Cloud release: "264" --- # Embedded Login Considerations When implementing Embedded Login, be aware of these considerations. ![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_warning.png) Warning In Summer ’24, Salesforce made Embedded Login disabled by default. We recommend that you use the [web server flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&type=5&language=en_US), the [user-agent flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&type=5&language=en_US), or another redirect-based OAuth 2.0 flow instead of Embedded Login. Embedded Login relies on third-party cookies, which are blocked or restricted in most browsers. And Embedded Login works only on Google Chrome and only as long as third-party cookies are allowed there by default. Supported Browsers Embedded Login is supported on all browsers that support Lightning Experience. Embedded Login works on these browsers: Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge, and Internet Explorer 11. HTTP and HTTPS URLs Modern browsers don’t allow mixing the HTTP and HTTPS protocols on the same page. Your right-frame content is inside an iframe, so the URL must use the same protocol as your site. Generally, we recommend using HTTPS for logo and right-frame URLs. However, in local and test environments, HTTP can be more flexible. URL Redirection for Self-Registration and Forgot Password Links Embedded Login relies on the site to handle self-registration and forgotten passwords. When customers complete the password or self-registration page, they must navigate back to your website. They’re not redirected to the website automatically. Login Redirects By default, Embedded Login uses a simple authentication process that’s completed inside an iframe and hidden from the user with a mask redirect. However, if one of these scenarios applies to your org, set the `salesforce-mask-redirects` metatag to `false`: - Your org uses a login flow that requires extra steps within the website, such as multi-factor authentication (MFA) or a custom login flow. - Your org uses a login page that requires extra steps within the website, such as a Login Discovery Page or custom login page. - Your org sets the OAuth Permitted Users policy for the Embedded Login external client app to All users may self-authorize. Error Configuring CORS If you get an error that contains the phrase `… an ancestor value violates the following Content Security Policy directive`, configure CORS according to instructions in [Step 1: Enable Resource Sharing Across Domains](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_1.htm&release=264.0.0&type=5 "Embedded Login entails making web requests outside the website boundaries, but for security reasons, web requests are restricted to the current domain. To enable a website to share resources beyond its boundaries, the Salesforce admin adds trusted website domains to Salesforce’s Cross-Origin Resource Sharing (CORS) allowlist. CORS is an industry standard that enables web browsers to make requests from origins other than their own."). HTML5 localStorage for Storing Data Embedded Login stores data locally within the user’s browser using `localStorage`, which is more secure than storing data in cookies. `localStorage` can store large amounts of data locally without affecting website performance. `localStorage` is per origin (per domain and protocol). All pages from one origin can store and access the same data. Data in `localStorage` has no expiration date and is cleared only through JavaScript or by clearing the browser cache or locally stored data. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png) Note If you get access denied messages, check whether `localStorage` is available. Missing Login Button Due to Limited Access to Cookies If a user sets the browser to block third-party websites from storing cookies and other data locally, the Login button doesn’t appear on the web page. For example, if the Chrome **Block third-party cookies** option is set, the Login button doesn’t appear. While this behavior applies to all browsers, it particularly applies to Safari because of its cookie and local storage blocking policies. To enable Embedded Login in Safari, deselect **Prevent cross-site tracking** in Safari’s privacy preferences. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png) Note Salesforce issues a session cookie only to record encrypted authentication information during a specific session. The session cookie doesn’t include the username and password of the user. Salesforce doesn’t use cookies to store other confidential user and session information. Instead, Salesforce implements more advanced security methods based on dynamic data and encoded session IDs.