Our login hung for exactly 10 seconds. Our own security headers did it.

Short summary

A debugging narrative where returning users experienced an exact 10-second login delay caused by their own security headers. The SPA's OIDC silent renew opened a hidden iframe against the identity provider, but X-Frame-Options: DENY and CSP frame-ancestors 'none' blocked the frame silently — no error event, just a timeout. Both the security headers and the silent-renew pattern were correct individually but incompatible together.

• •10-second login hang was the default silentRequestTimeout in oidc-client-ts
• •Security headers (X-Frame-Options: DENY, CSP frame-ancestors 'none') silently blocked the hidden OIDC renew iframe
• •Both the security configuration and OIDC pattern were individually correct but mutually incompatible

Generated with AI, which can make mistakes.