Correct security headers caused 10-second login delay by blocking silent auth iframe

A web portal's returning users experienced a consistent 10-second loading delay before the login page appeared, while first-time visitors were unaffected. The culprit was the app's silent sign-in mechanism, which used a hidden iframe to check for an existing session via the OIDC protocol. The identity provider's own security headers — X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' — correctly blocked the iframe from rendering, as they were configured to prevent clickjacking attacks. Because a blocked iframe fires no error event, the authentication library simply waited until its default 10-second timeout expired before redirecting users to the login page. The issue was not a malfunction but an unintended conflict between a legitimate security measure and a silent authentication fallback mechanism.