Summary
Your company uses SSL VPN via Citrix NetScaler to provide secure access for employees and customers. When users connect, they are presented with the VPN portal homepage, styled with the X1 theme.
From the portal menu, clicking the “Citrix Applications” link is intended to open the Citrix Receiver page, as defined in the session profile. However, when using Microsoft Edge (Chromium-based), the Citrix Receiver page fails to load or is refused.


Description
When accessing Citrix StoreFront through the Citrix NetScaler VPN portal homepage (configured with the X1 theme), the X-Frame-Options settings in StoreFront may block the HTTP request from the Microsoft Edge (Chromium)browser.
Even if you’ve followed the guidance in Citrix article CTX202890, the frame-ancestors directive provided in the article does not fully resolve the issue when used with Microsoft Edge Chromium in combination with the X1 theme.
To fix this, you need to supplement the frame-ancestors directive with the FQDN of the StoreFront server, or include the domain and top-level domain of your internal environment.
Using wildcards in the frame-ancestors value is also supported and, in most cases, provides the simplest and most flexible solution—without compromising the security of IIS or Edge.
To verify the issue, you can use the Developer Tools in Microsoft Edge Chromium to inspect the HTTP response and view the specific refused request error.

Configuring the
1
web.config
File in Citrix StoreFront
1 | web.config |
To resolve the frame blocking issue, open the web.config file for the affected StoreFront Web Store located at:
C:\inetpub\wwwroot\Citrix\StoreWeb\web.config
Search for the X-Frame-Options or Content-Security-Policy directive.
-
- Locate the frame-ancestors setting.
- Add your StoreFront FQDN or your top-level domain to the
- frame-ancestors value, as shown in the example or screenshot.
Example:
Content-Security-Policy: frame-ancestors ‘self’ https://storefront.yourdomain.com
This configuration ensures proper loading of the StoreFront page within the Citrix NetScaler VPN portal—especially when using the X1 theme and Microsoft Edge Chromium.
frame-ancestors with Storefront FQDN configuration in the X-Frame-Options

frame-ancestors with wildcard domain and top level configuration in the X-Frame-Options
With the configured frame-ancestors in the X-Frame-Options, the Storefront Receiver page will be no longer refused.










