You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When Grok redirects an embedded panel to accounts.x.ai for authentication, Firefox can refuse to render the page because the login origin does not allow itself to be framed.
accounts.x.ai will not allow Firefox to display the page if another site has embedded it.
Refreshing the Grok panel may work after the user is already signed in.
Expected behavior
Grok authentication should have a supported flow that does not leave the embedded panel on a blocked login page. If authentication cannot safely run inside the iframe, Panelize should offer a clear top-level login fallback and then reload the panel.
Current evidence
Panelize embeds https://grok.com/.
The current host permissions and iframe response-header rule cover grok.com, but not accounts.x.ai.
Local reproduction on macOS Firefox 153.0 is currently blocked because the source manifest on main cannot be loaded directly in Firefox (background.service_worker is currently disabled. Add background.scripts.). The original Windows Firefox report therefore still needs confirmation with a Firefox-compatible build.
Investigation checklist
Reproduce the redirect and capture the final iframe URL plus response headers on Windows Firefox.
Confirm whether the failure occurs only when the Grok session is signed out or expired.
Evaluate a top-level login flow before considering any permission or response-header changes for accounts.x.ai.
Reload the Grok panel after authentication and verify the session is recognized.
Add a regression test for the chosen fallback behavior.
Summary
When Grok redirects an embedded panel to
accounts.x.aifor authentication, Firefox can refuse to render the page because the login origin does not allow itself to be framed.Environment
Originally reported in #52:
Observed behavior
Firefox shows:
Refreshing the Grok panel may work after the user is already signed in.
Expected behavior
Grok authentication should have a supported flow that does not leave the embedded panel on a blocked login page. If authentication cannot safely run inside the iframe, Panelize should offer a clear top-level login fallback and then reload the panel.
Current evidence
https://grok.com/.grok.com, but notaccounts.x.ai.maincannot be loaded directly in Firefox (background.service_worker is currently disabled. Add background.scripts.). The original Windows Firefox report therefore still needs confirmation with a Firefox-compatible build.Investigation checklist
accounts.x.ai.Related