Connect with PayPal Button doesn't work

[Nico_Frankhood]

Hi, since yesterday I had problems with connect button to paypal from site where I work

I also built my button to connect at paypal from here: https://developer.paypal.com/docs/integration/direct/identity/button-js-builder/

adding more parameters but I have always the same problem.

In browser console I see these two errors:

 - Unsafe JavaScript attempt to initiate navigation for frame with origin 'https://produzionidalbasso.servercdn.it' from frame with URL 'https://www.sandbox.paypal.com/signin/consent'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener. 

- Uncaught DOMException: Failed to set the 'href' property on 'Location': The current window does not have permission to navigate the target frame to 'https://produzionidalbasso.servercdn.it/projects/paypalverified/?code=C21AAHmPhqchC_AT1osF_84oHeBrE4...'.

the script that I insert in my page is:

<script src='https://www.paypalobjects.com/js/external/connect/api.js'></script>

<script>
paypal.use( ['login'], function (login) {
login.render ({
"appid":"<my_paypal_client_id>",
"scopes":"openid",
"containerid":"paypalLoginButton",
"responseType":"code",
"locale":"it-it",
"buttonType":"CWP",
"buttonShape":"rectangle",
"buttonSize":"sm",
"fullPage":"false",
"returnurl": "<my_return_url>"
});
});
</script>
<span id='paypalLoginButton'></span>

[Frigidman]

Interestingly we have run into this sort of problem now with the "Log In with PayPal" button (lippButton) and javascript.

Upon placing that button inside a frameset on our service, a user clicks the button, gets a popup window to login to their paypal, and then it sits spinning endlessly because the parent page that created that popup window is now 'refusing the url to be changed by the paypal js'.

A cross domain security issue.

The thing is..... we'd had this code running and in place for about two years straight without fault for all our users. Then suddenly, sometime in the last month this has now become an issue when we changed no code on our end.

Frustrating fighting some of these cross origin security issues because browsers are dogpiling even more restrictions in place to protect everyone from the malicious people in the world. Sadly it means we have to re-engineer and format, change whole flows, and design styles ... just to get around the problem again.

Sorry, I have no solution to your issue....... we still have not found one ourselves.