title: Msal.js iframe issue with twitter and while choosing from multiple google account
body: <p>I was going through <a href="https://github.com/AzureAD/microsoft-authentication-library-for-js" rel="nofollow noreferrer">AzureAD msal library</a> for javascript. I tried to run the <a href="https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/devApps/VanillaJSTestApp-b2c" rel="nofollow noreferrer">test app</a> given in the same github link.</p>
  
  <p>The app runs smoothly with facebook or microsoft account login. But when I try to login with twitter, it throws the following error: </p>
  
  <pre><code>Refused to display 'https://api.twitter.com/oauth/authenticate?oauth_token=....' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' https://tweetdeck.twitter.com https://tdapi-staging.smf1.twitter.com https://tdapi-staging.atla.twitter.com https://tweetdeck.localhost.twitter.com". 
  </code></pre>
  
  <p>Also, the example works well when I have a <strong>single google account</strong> logged-in in my browser or when I enter google credential on the google login page. But when I have multiple google accounts logged-in and choose one of them for the app, it throws the following error: </p>
  
  <pre><code>Refused to display 'https://accounts.google.com/o/oauth2/auth?.....' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
  </code></pre>
  
  <p>In both the cases (twitter and multiple google accounts), the login happens, id token is generated but it fails to get access_token using <code>acquireTokenSilent()</code> and throws the above mentioned error. Then because of the <code>acquireTokenpopup()</code>, the login popup window shows again and when I enter my same credentials again, I get the access_token.</p>
  
  <p>I have tried using <code>loginRedirect()</code> &amp; <code>acquireTokenRedirect()</code> instead of popup but I have seen the same behavior.</p>
  
  <p>What I have understood so far: </p>
  
  <p>In the error cases, iframe is trying to add the google/twitter link into iframe src in the app home page (which is obviously not allowed).</p>
  
  <p>In case of successful acquiring of access_token, I saw the iframe src has a microsoft login link (<a href="https://login.microsoftonline.com" rel="nofollow noreferrer">https://login.microsoftonline.com</a> ...).</p>
  
  <p>Can somebody help me understand why is it happening? And if someone has got a way to solve this, please help me out.</p>
  
  <p>I haven't changed anything in the code, I just wanted to understand how msal.js works so that I can implement it in another project.  </p>