SAP Ariba PunchOut Iframe Error: Causes and Fix

The error people search for

Typical message

The iframe has not configured - see warning in console

The wording varies by browser and buyer system: a blank frame, a “refused to connect” page, or a session that loses the login or the cart after the first click. The cause is almost always one of the four below.

Why the frame is blocked

X-Frame-Options

DENY or SAMEORIGIN stops any other site from framing your store.

CSP frame-ancestors

A Content-Security-Policy without the buyer’s domain blocks the frame.

SameSite cookies

Without SameSite=None; Secure the session cookie is dropped inside the frame: login and cart are lost.

Third-party cookie blocking

Safari and some browser settings block cookies in frames regardless of the attributes.

Fix it on your server

Read the browser console
Open the developer tools during a test session and note the blocked header or cookie.
Allow the buyer’s domain in frame-ancestors
Add only the buyer’s domains to your Content-Security-Policy, never *.
Remove X-Frame-Options DENY or SAMEORIGIN
It cannot list several domains; frame-ancestors replaces it.
Set session cookies to SameSite=None; Secure
Otherwise the browser drops them inside the frame and login and cart are lost.
Test a new PunchOut session
Start a fresh session from the buyer’s test system and check login and cart return.

Example headers

Content-Security-Policy: frame-ancestors 'self' https://*.ariba.com
Set-Cookie: session=…; Path=/; Secure; HttpOnly; SameSite=None

Check the exact domains with your buyer: SAP Ariba, Coupa and other systems use different hosts for test and production. Apply the change only to what the PunchOut session needs, and keep your other security headers.

When the browser still blocks cookies

Even with the right attributes, browsers that block third-party cookies by default can still drop your session inside a frame. The robust fixes are to open the store in a new window when the buyer’s system allows it, or to serve the store through a proxy on a domain that the browser treats as first-party for the session.

Or let the gateway handle it

PunchOut Rocket serves your store to the buyer through its gateway, a reverse proxy that sets the right frame headers and cookie attributes for each PunchOut session. Nothing changes on your server or theme, and your normal customers keep the security settings they have today.

PunchOut on the store you already have

PunchOut Rocket connects WooCommerce, Magento, PrestaShop and nopCommerce to SAP Ariba, Coupa and SAP via cXML or OCI. From €163/month per site, 30-day free trial.

Start free trial See how it works

FAQ

Questions

Why does my store not open inside SAP Ariba?

Usually because the store forbids being shown in a frame (X-Frame-Options or CSP frame-ancestors) or because its session cookie is blocked as a third-party cookie (SameSite).

Is it safe to allow framing?

Yes, if you allow only the buyer’s domains in frame-ancestors, not every site.

Does PunchOut Rocket fix this for me?

Yes. The gateway’s reverse proxy serves your store with the frame headers and cookie attributes the buyer’s system needs, without changing your server.

Keep reading

Related guides