Silent SSO inside iframe getting BrowserAuthError: timed_out

Question

Silent SSO inside iframe getting BrowserAuthError: timed_out

Ajit Kumar Singh 1

I have a parent application running on localhost:3000 which is using the entra id authentication. Inside the parent application I have embedded child application running on localhost:4000. Both the application are Next JS apps. After authentication from the parent application, I am pulling the email of the user from the session and passing it to the child as a Iframe query parameter.
My child app is registered as Single page application and configured with redirect uri as http://localhost:4000/blank.html.
When my parent app is authenticated and loads the child app passing the email as login it, I have my IframAuth.tsx inside me child which pulls the login hint value and call the ssoSilent({scopes: ["user.read"],loginHint: emaild}). In the network tab I see 200 status code call to the https://login.microsoftonline.com endpoint which calls the blank.html redirect uri. Inside blank.html I see the #code=1.AQcAp.. response as well but after sometime I see the msal throws BrowserAuthError: timed_out error. Please help me with this.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-17T20:08:46.83+00:00
Hello Ajit Kumar Singh,

What you’re seeing is expected with this setup.

Even though the call to login.microsoftonline.com succeeds and you can see the #code=... in blank.html, MSAL isn’t able to complete the flow inside the iframe. That’s why it eventually throws BrowserAuthError: timed_out.

This is mainly due to browser restrictions:

Silent SSO relies on cookies from the identity platform

Inside an iframe, these are treated as third-party cookies and are often blocked

As a result, MSAL can’t properly process the response

Also, since your apps are running on different origins (localhost:3000 and localhost:4000), this behavior is more likely.

Because of these limitations, using ssoSilent() inside an iframe isn’t a supported pattern.

A better approach is to handle authentication in the parent app and pass the token to the child app using window.postMessage. The child can then use that token instead of trying to authenticate again.
Ajit Kumar Singh 1 Reputation point

2026-04-17T20:21:31.0966667+00:00

Hello @Sridevi Machavarapu **
**My parent app in real world is a dynamics 365 with domain *.dynamics.com which will be embedding a new application as an Iframe with a new domain for example childapp.com. The child app will calling different microservices with exposed rest api's which are owned by the child app. So how can I pass the token from parent and use that?
The token passed from the parent to the child will just be the accesstoken to access the user profile.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-17T21:19:09.67+00:00
Hello Ajit Kumar Singh,

In this setup, passing the access token from the parent (Dynamics 365) to the child app is not recommended.

The token issued to the parent application is intended for that app (or its APIs). It won’t be valid for your child app’s APIs, and sharing tokens across domains can introduce security risks.

A better approach is:

Pass only basic user context from the parent to the child (for example, login hint / email) using window.postMessage

Let the child application authenticate itself using MSAL and acquire tokens for its own APIs

Since the child app is running inside an iframe, ssoSilent() may still fail due to browser restrictions on third-party cookies. To handle this:

Try ssoSilent() with the login hint

If it fails, fall back to loginPopup() to complete authentication

This ensures the child app gets a valid token for its own backend APIs without relying on tokens issued to the parent.
Ajit Kumar Singh 1 Reputation point

2026-04-18T02:03:50.4333333+00:00

As, I had mentioned in my question (My first post), I am passing the loginHint which is the email id from my parent app to the child to reauthenticate the user using ssoSilent. The entra id is doing the authentication and is doing the redirect to my blank.html which has the has code (#code=) but its throwing timeout error as the hash code from blank.html is not being send to the MSAL. I tried loginPopup as will but I see the application getting stuck on the popup.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-18T02:15:05.07+00:00
Hello Ajit Kumar Singh,

Since you can see #code=... in blank.html, the authentication itself is working. The timeout happens because MSAL isn’t able to finish processing that response inside the iframe.

This isn’t related to your loginHint or configuration. It’s due to browser restrictions:

The response is returned, but MSAL can’t reliably read it inside an iframe

Storage/cookies required to complete the flow are restricted in this context

As a result, MSAL waits and eventually times out

Regarding loginPopup() getting stuck, this can also happen when triggered from an iframe, as some browsers limit popup-based auth from embedded frames.

Because of this, completing authentication inside the iframe isn’t reliable.

What you can do instead:

Try ssoSilent() as you are doing

If it fails, trigger authentication in a top-level context (for example, open a new window or redirect outside the iframe)

Once the user signs in, the child app should work without hitting this issue again.
Ajit Kumar Singh 1 Reputation point

2026-04-20T15:59:53.6+00:00

@Sridevi Machavarapu I have followed the below document for doing silentSSO available on the microsoft portal and it does not provide any way to open a new window. Do we have any document related to the approach you suggested?
https://learn.microsoft.com/en-us/entra/msal/javascript/browser/iframe-usage
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-20T22:17:33.6766667+00:00
Hello Ajit Kumar Singh,

That document explains how ssoSilent() works, but it doesn’t guarantee it will work in cross-domain iframe scenarios. In your case, the request reaches blank.html and returns #code=..., but MSAL can’t complete the flow due to browser restrictions (third-party cookies and storage in iframes), which leads to the timeout.

Because of this, completing authentication fully inside an iframe isn’t reliable.

There isn’t a specific document for the “open in new window” approach. It’s a practical workaround used when silent SSO fails in embedded apps.

What you can do:

Try ssoSilent() with loginHint

If it fails, trigger authentication in a top-level context (redirect or new window)

After that, the session can be reused without the same issue

This is based on current browser behavior rather than a problem in your setup.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-21T23:19:59.5133333+00:00

Hello Ajit Kumar Singh,

Any update on this? Please confirm if you still have further queries.

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-17T20:08:46.83+00:00

Hello Ajit Kumar Singh,

What you’re seeing is expected with this setup.

Even though the call to login.microsoftonline.com succeeds and you can see the #code=... in blank.html, MSAL isn’t able to complete the flow inside the iframe. That’s why it eventually throws BrowserAuthError: timed_out.

This is mainly due to browser restrictions:

Silent SSO relies on cookies from the identity platform

Inside an iframe, these are treated as third-party cookies and are often blocked

As a result, MSAL can’t properly process the response

Also, since your apps are running on different origins (localhost:3000 and localhost:4000), this behavior is more likely.

Because of these limitations, using ssoSilent() inside an iframe isn’t a supported pattern.

A better approach is to handle authentication in the parent app and pass the token to the child app using window.postMessage. The child can then use that token instead of trying to authenticate again.
Ajit Kumar Singh 1 Reputation point

2026-04-17T20:21:31.0966667+00:00

Hello @Sridevi Machavarapu **
**My parent app in real world is a dynamics 365 with domain *.dynamics.com which will be embedding a new application as an Iframe with a new domain for example childapp.com. The child app will calling different microservices with exposed rest api's which are owned by the child app. So how can I pass the token from parent and use that?
The token passed from the parent to the child will just be the accesstoken to access the user profile.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-17T21:19:09.67+00:00

Hello Ajit Kumar Singh,

In this setup, passing the access token from the parent (Dynamics 365) to the child app is not recommended.

The token issued to the parent application is intended for that app (or its APIs). It won’t be valid for your child app’s APIs, and sharing tokens across domains can introduce security risks.

A better approach is:

Pass only basic user context from the parent to the child (for example, login hint / email) using window.postMessage

Let the child application authenticate itself using MSAL and acquire tokens for its own APIs

Since the child app is running inside an iframe, ssoSilent() may still fail due to browser restrictions on third-party cookies. To handle this:

Try ssoSilent() with the login hint

If it fails, fall back to loginPopup() to complete authentication

This ensures the child app gets a valid token for its own backend APIs without relying on tokens issued to the parent.
Ajit Kumar Singh 1 Reputation point

2026-04-18T02:03:50.4333333+00:00

As, I had mentioned in my question (My first post), I am passing the loginHint which is the email id from my parent app to the child to reauthenticate the user using ssoSilent. The entra id is doing the authentication and is doing the redirect to my blank.html which has the has code (#code=) but its throwing timeout error as the hash code from blank.html is not being send to the MSAL. I tried loginPopup as will but I see the application getting stuck on the popup.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-18T02:15:05.07+00:00

Hello Ajit Kumar Singh,

Since you can see #code=... in blank.html, the authentication itself is working. The timeout happens because MSAL isn’t able to finish processing that response inside the iframe.

This isn’t related to your loginHint or configuration. It’s due to browser restrictions:

The response is returned, but MSAL can’t reliably read it inside an iframe

Storage/cookies required to complete the flow are restricted in this context

As a result, MSAL waits and eventually times out

Regarding loginPopup() getting stuck, this can also happen when triggered from an iframe, as some browsers limit popup-based auth from embedded frames.

Because of this, completing authentication inside the iframe isn’t reliable.

What you can do instead:

Try ssoSilent() as you are doing

If it fails, trigger authentication in a top-level context (for example, open a new window or redirect outside the iframe)

Once the user signs in, the child app should work without hitting this issue again.
Ajit Kumar Singh 1 Reputation point

2026-04-20T15:59:53.6+00:00

@Sridevi Machavarapu I have followed the below document for doing silentSSO available on the microsoft portal and it does not provide any way to open a new window. Do we have any document related to the approach you suggested?
https://learn.microsoft.com/en-us/entra/msal/javascript/browser/iframe-usage
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-20T22:17:33.6766667+00:00

Hello Ajit Kumar Singh,

That document explains how ssoSilent() works, but it doesn’t guarantee it will work in cross-domain iframe scenarios. In your case, the request reaches blank.html and returns #code=..., but MSAL can’t complete the flow due to browser restrictions (third-party cookies and storage in iframes), which leads to the timeout.

Because of this, completing authentication fully inside an iframe isn’t reliable.

There isn’t a specific document for the “open in new window” approach. It’s a practical workaround used when silent SSO fails in embedded apps.

What you can do:

Try ssoSilent() with loginHint

If it fails, trigger authentication in a top-level context (redirect or new window)

After that, the session can be reused without the same issue

This is based on current browser behavior rather than a problem in your setup.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-21T23:19:59.5133333+00:00

Hello Ajit Kumar Singh,

Any update on this? Please confirm if you still have further queries.