Hello,

Our Website which uses our Salesforce Community for IDM is getting a cross site error when we login.  This just started this morning after work was done to add in a login flow in Regular Salesforce to track login activity and now the login process from our website includes a call to "/loginflow/lightningLoginFlow.apexp" with a query string parameter of the salesforce authorize endpoint and a sparkid parameter.

It now also sets these headers which doesn't include other sites where we are seeing the error on:

Content-Security-Policy         frame-ancestors 'self' *.herokuapp.com

X-FRAME-OPTIONS                SAMEORIGIN

Is there a way to prevent the call to the new endpoint above or at least have it include the other website URL's we setup in CORS and in the community scripting security settings to the above header?

Thank You,

Brian