Trying to bypass the SAMEORIGIN error while using Google's JavaScript API is a timeless challenge.
Here is an example of what I have tried:
let clientId = 'CLIENT_ID';
let apiKey = 'API_KEY';
let scopes = 'https://www.googleapis.com/auth/youtube.readonly';
gapi.client.setApiKey(apiKey);
setTimeout(() => {
gapi.auth.authorize({client_id: clientId, scope: scopes, immediate: true}, (authResult) => {
console.log(authResult);
});
});
However, I encountered the following error:
Refused to display '. . .' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.
The API Key is configured as a Browser Key and the Client ID as a Web Application.
I attempted testing this via localhost, adding http://localhost:8000 to Authorized JavaScript Origins in the API Key. Though unconventional, it was worth a try.
The API key has no domain restrictions and there is no domain verification for OAuth.
I also attempted running Chrome with --disable-web-security, but that did not resolve the issue.