IFrame limitations

An iframe is an HTML element that displays one website inside another. Optimizely Configured Commerce storefronts run as top-level websites and cannot keep a shopper session inside another site's iframe. PunchOut is the exception. Read this article before you render a storefront or a PunchOut session inside a procurement system.

Configured Commerce uses cookies to keep a shopper's session with the storefront APIs. By default, these cookies use SameSite=Lax. Browsers do not send SameSite=Lax cookies from inside a third-party iframe. A storefront rendered inside another site's iframe therefore loses its session. Configured Commerce does not set every storefront cookie to SameSite=None, because that limits API functionality.

PunchOut lets buyers shop a supplier's storefront from inside their own procurement system. Some procurement systems, such as SAP Ariba, render the PunchOut site inside an iframe. To support them, turn on the Allow PunchOut in an iframe setting. The storefront then adds SameSite=None; Secure to cookies it writes during a PunchOut session over HTTPS. Other storefront cookies keep their default attributes. The setting is off by default.

See Allow PunchOut in an iframe for details, including the frame-ancestors directive that prevents clickjacking.

The buyer's procurement system, not the supplier's storefront, decides whether PunchOut opens in an iframe or a pop-up window. In a pop-up window, the storefront is the top-level website. PunchOut works there with the default cookie settings.

In SAP Ariba, the buyer's Ariba site (called a realm) controls the display mode. The buyer's administrator sets the Prevent using iframes for punching out parameter to one of the following values:

Other procurement systems use their own settings. Confirm the display mode with the buyer's procurement administrator before you configure the storefront.

PunchOut in an iframe works only in browsers that accept third-party cookies. The following browsers keep the PunchOut session at their default settings:

The following browsers block third-party cookies regardless of the cookie attributes:

In these browsers, the storefront treats the buyer as signed out inside the iframe, and checkout fails. The browser causes this failure, not the storefront. Buyers who use these browsers need PunchOut in a pop-up window. Ask the buyer's procurement administrator to change the display mode.