@AzaharuddinM This is a GenAI-powered tool. All generated answers require validation against the provided references.

The behavior you're describing—where the entire browser refreshes instead of just the iframe content during login attempts—is a known issue that can occur with embedded iframe components under specific conditions.

Potential Causes

Based on my research, this issue is likely caused by one or more of the following factors:

1. Browser Third-Party Cookie Settings: The most common cause of this behavior is third-party cookies being blocked in the browser. This can lead to incorrect OAuth behavior in systems that use external authentication services.
2. Domain Configuration Mismatch: When the web address of the web embed page is from a different root domain than the one specified in the pegaServerUrl attribute value, it can cause full page refreshes instead of isolated iframe refreshes.
3. Authentication Flow Handling: While Pega Constellation 24.2 has improved authentication handling for web embeds (no longer relying on the Pega-RULES cookie), there may still be configuration issues affecting the proper flow.

Recommended Solutions

Here are the steps I recommend to resolve this issue:

1. Enable Third-Party Cookies

Ensure that third-party cookies are enabled in the browser where you're testing the iframe component. This is crucial for proper OAuth behavior.

2. Check Domain Configuration

Verify that the web address of the web embed page is from the same root domain as the domain specified in the pegaServerUrl attribute value. For example, if your pegaServerUrl is pointing to app.example.com, your embedding page should also be on the example.com domain.

3. Configure Authentication Properly

If you're using an external authentication service:

• Ensure OAuth 2.0 client registration is properly configured
• Verify that security settings are not blocking OAuth 2.0 client redirects in the hidden iframe

4. Implement a Proxy Server if Needed

If you cannot ensure the same root domain for both the embedding page and Pega server:

• Consider deploying a proxy server to proxy the common domain-configured host address to the actual back-end server hosting the top-level page

5. Review iframe Component Implementation

Check your iframe implementation to ensure it's correctly configured:

• If using the iFrameLoginUI attribute, be aware that while this is a workaround for limiting pop-up windows, it has specific requirements
• In Constellation 24.2, web embeds have enhanced error handling for OAuth 2.0 flows that should help prevent some of these issues

Additional Testing

If the above solutions don't resolve the issue, I recommend:

1. Testing with different browsers to see if the behavior is browser-specific
2. Checking browser developer console for any error messages during the refresh process
3. Verifying that session management policies are appropriately configured

References:

• Troubleshooting web embeds
• Authentication in web embeds
• Securing your application user interface