Hi @SaifNeon,
to prevent Cross Site Request Forgery attacks as described in your scenario, we set the header X-Frame-Options: SAMEORIGIN. The iframe you are using does not match the allowed origin.
This is a security feature and will not be broken.
Cheers,
Tobias