I am unable to update our apps on an on-prem SharePoint site.

When I click the update link on our SharePoint app from the site contents page, I am taken to the storefront.aspx page where I can click "Get it" to update the app. When I click "Get it", a dialog box (appinv.aspx) opens up with a message saying that the ad domain refused to connect.

enter image description here

When inspect the page, an error is showing up in the console: "Refused to display 'http://domain.ad' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN'). Falling back to 'deny'".

enter image description here

When I access the Network tab in Chrome Dev Tools, I see that there are 2 X-FRAME-OPTIONS being set in the HTTP Response Headers section. There is an X-FRAME-OPTIONS with a value of "DENY" and another X-FRAME-OPTIONS with a value of "SAMEORIGIN". I looked in IIS and found no X-FRAME-OPTIONS with a value of "DENY" and there does not seem to be any duplicate X-FRAME-OPTIONS headers to be found anywhere on the server. I am unsure where this is being set and I'm unable to locate it.

enter image description here

Has anyone experienced this before? If so, how can I resolve? Is there a workaround for this?

1 Answer 1


To remedy this, make sure the SharePoint Server has been updated with this or later:

SharePoint Server 2019: September 14, 2021 (KB5002018)
SharePoint Enterprise Server 2016: September 14, 2021 (KB5002020)
SharePoint Foundation 2013: September 14, 2021 (KB5002024)

Log onto the SharePoint server and open a Windows Powershell command window as Administrator. Run the following commands:

add-pssnapin *
$f.AddGenericAllowedListValue("AllowIframeAppAuthorizePageDomains","<domain name>")


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.