Some sites have some headers that help prevent where data can be displayed. They might look like this one from the adp.com site.
X-Content-Security-Policy=default-src 'self' *.adp.com *.google.com ; frame-src * ; img-src * ; options inline-script eval-script; frame-ancestors https://*.adp.com ;
Content-Security-Policy=default-src 'self' *.adp.com *.google.com ; frame-src * ; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src https://*.adp.com; style-src 'self' 'unsafe-inline'; img-src * ;
These prevented the page from running in a virtual webapp. To fix this, we were able to modify the headers on the webapp. The header rule looked like this:
Header Rule #1:
$Content-Security-Policy
.*~off
Header Rule #2:
$X-Content-Security-Policy
.*~off
This basically set the header to "off" and allowed the data to display correctly.
An explanation of these headers can be found
here
If you want to maintain the security, you could use a header rule to change:
Content-Security-Policy:default-src 'self' *.adp.com *.google.com ; frame-src * ; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src https://*.adp.com; style-src 'self' 'unsafe-inline'; img-src * ;
to something like this:
Content-Security-Policy:default-src 'self' *.adp.com *.stone-ware.com *.google.com ; frame-src * ; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src https://*.stone-ware.com https://*.adp.com; style-src 'self' 'unsafe-inline'; img-src * ;