---
title: IFrame limitations
slug: configured-commerce/docs/iframe-limitations
docTags: 
createdAt: 2026-08-13T10:46:23.000Z
---

Optimizely Configured Commerce uses SameSite cookies to authenticate with the APIs. By default, storefront cookies use `SameSite=Lax`, which browsers do not send from inside a third-party iframe. Setting these cookies to `None` instead of `Lax` or `Strict` for the whole storefront would limit API functionality, so a storefront rendered inside another site's iframe cannot keep a session.

PunchOut is the exception. Some procurement platforms, such as SAP Ariba, render the supplier's PunchOut site inside an iframe. To support them, turn on the **Allow PunchOut in an iframe** setting. Cookies written for a PunchOut session over HTTPS then use `SameSite=None; Secure`. All other storefront cookies keep their default attributes. The setting is off by default. See [Allow PunchOut in an iframe](docId\:nFx7ajsIOfc8nR1HTN2w1) for details, including the `frame-ancestors` directive you must add to prevent clickjacking.

If you are using PunchOut and do not turn on this setting, render PunchOut as a pop-up window. Also use a pop-up window for buyers whose browsers block all third-party cookies, because those browsers do not store the PunchOut cookies even when the setting is on.