I have been testing our Wayfinder implementation using NHS Login in the NHS Login Sandpit environment for months now without problems. Now, without (as far as I am aware!) changing anything on our side, I am getting problems. I can still use NHS Login to successfully authenticate any of the set of patients in the Sandpit into my NHS App emulator web application. But when I click on an appointment to invoke the deep link in our Wayfinder solution, which authenticates using NHS Login in SSO mode, the authentication is failing with an error “access.sandpit.signin.nhs.uk refused to connect”. This all used to work fine. Has anything changed in NHS Login in the Sandpit? (I notice that it is now showing support for Passkeys, so something has changed, but I don’t know if that is relevant.)
Hi @paul.dayan Have you had a reply to this via the NHS login Private Space? Thanks. Tim
Hi Tim. Thanks for asking. No, I haven’t received any replies.
Afternoon Paul, I can have a look at this for you. Could you confirm your client ID please.
Could you also confirm when you got the error so I can check the logs?
Hi Stephen. Thanks very much for getting back to me. Our client ID in the Sandpit is I4HWayfinder. I have just recreated the issue. Time was 16:50.
I can see in our looks the SSO request is successful and so we handoff to the relevant service which would be NHS App. Have you asked NHS App if they are seeing any errors their side?
Thanks very much, Steve. I am not using the NHS App as such - I don’t think it’s available in the NHS Login Sandpit. I am using an NHS App emulator web application I developed in order to test our Wayfinder solution, running on my laptop. So if the SSO login is working, NHS Login should be redirecting the browser to my client redirect URL, which I think is “https://ukvmpdayan.iscinternal.com:443/healthconnect/csp/sys/oauth2/OAuth2.Response.cls”. Is that what you are seeing?
Does the error:
NHS login in Sandpit now erroring “access.sandpit.signin.nhs.uk refused to connect”
tell you anything? What is access.sandpit.signin.nhs.uk?
Aaahhhh - you can have two client IDs in sandpit @paul.dayan to represent NHS App and your client. Would that be easier? If yes - please specify an alternative to your NHS login Wayfinder product client. Tim
Hi Tim. Thanks for the suggestion. I don’t know if or how that would help. @Stephen_Willis is saying that the authentication of the deep link UI is succeeding, so it must be something happening after the authentication. The thing is, my authentication has been working fine for several months. So something has changed recently in NHS Login in the Sandpit. Do we know what has changed?
Morning Paul,
Yeah looking at our logs the SSO is successful and we are redirecting.
I am not aware of anything changing.
Would you be able to maybe record a short video showing what you are seeing?
Hi Steve. I have captured a recording. Developer Community says the file is too large to attach. Please e-mail me your e-mail address and I will send it by e-mail. My e-mail address is paul.dayan@intersystems.com.
I’m not sure it will help much, though. All that you see is the error I reported when the user clicks on an appointment.
I will do some debugging at our end.
Thanks, Steve. I’ve e-mailed the recording. Hopefully it will get to you!
Hi Steve. I’ve tried observing network behaviour in the Microsoft Edge Developer Tools.
What I see is that:
https://auth.sandpit.signin.nhs.uk/authcode…
initiates a request to:
This results in a Console error:
Refused to display ‘https://access.sandpit.signin.nhs.uk/’ in a frame because it set ‘X-Frame-Options’ to ‘sameorigin’.
Copilot explains this as:
The NHS login page cannot be embedded inside an iframe on your emulator page because the server at access.sandpit.signin.nhs.uk explicitly tells browsers:
“Only display this page if the parent page is from the same origin as me.”
Your page is not the same origin, so the browser blocks it.
I presume this is NHS Login trying to display the patient consent page in the iframe in my NHS App emulator web application which is trying to display the appointment deep link UI.
Does this simply mean that NHS Login has been changed so that it no longer supports the consent page being displayed in an iframe?
Hi Steve,
That was indeed the problem. If I open the deep link UI in a separate window rather than an iframe, the NHS Login consent page is displayed. If I consent, my deep link UI is displayed.
So it seems there has been a change in the NHS Login consent page, and it now no longer supports being displayed in an iframe. I will adapt our UI accordingly.