Content Security Policy framing error when using Eve embedded widget in Litify

Last updated: April 10, 2026

Overview

This article covers why users may encounter a "Content Security Policy directive: frame-ancestors 'none'" error when trying to view Eve from Salesforce/Litify and how to resolve it. This error occurs when the Eve embedded widget attempts to load within Litify but the user doesn't have an active Eve session in their browser.

Before You Start — Diagnosis

Confirm the following before attempting any fixes:

  • The error message mentions "frame-ancestors 'none'" and references login.eve.legal

  • The issue occurs specifically when accessing Eve through the Litify integration

  • Users can access Eve directly outside of Litify without issues

Fixes

Start with the most common cause and work toward edge cases.

Fix 1 — User Not Logged Into Eve

  • Cause: The Eve embedded widget requires an active Eve session in the browser to function properly within Litify. Without being logged in, the Content Security Policy blocks the iframe from loading.

  • Fix: Have the user log into Eve in a separate browser tab or window before accessing the Eve widget through Litify. Keep the Eve session active while using the Litify integration.

  • Expected Outcome: The Eve embedded widget should load properly within Litify without the framing error.

Fix 2 — Expired Eve Session

  • Cause: The user's Eve session may have expired while working in Litify, causing the embedded widget to fail when it tries to authenticate.

  • Fix: Refresh the Eve login by navigating to Eve in a separate tab, logging in again, then returning to the Litify interface and refreshing the page.

  • Expected Outcome: The Eve widget should function normally after the session is refreshed.

Fix 3 — Browser Session Isolation

  • Cause: Some browser configurations or security settings may isolate sessions between different domains, preventing the Eve widget from accessing the authentication state.

  • Fix: Ensure both Eve and Litify are accessed in the same browser profile and that third-party cookies are not blocked for these domains. Try using an incognito/private window to test if browser extensions are interfering.

  • Expected Outcome: The embedded widget should load without Content Security Policy errors.