Browser Extension Blocks Company Sign-In Page: Diagnose and Fix

TL;DR — If your company sign-in page is blank, stuck in a redirect loop, or the button does nothing, the most likely cause is a privacy, ad-blocking, script-blocking, or password-manager extension interfering with the login flow. The fastest test is to open the sign-in page in a private/incognito window with extensions disabled, or in a different browser profile; if it works there, disable the extension for your sign-in domain or add the site to the extension's allowlist. Reading time: ~6 min

The scenario

It is a normal Tuesday afternoon. You click your company's "Sign in" button, the page flashes, and then either goes blank, reloads forever, or never finishes loading the identity provider (the service that verifies your login) page. A coworker says login works fine for them, and your status page shows no outage. You can browse the public site, but the secure part of the app will not let you in, and you need access now.

Symptoms

• The sign-in page is blank or partially rendered.
• The page keeps reloading between two URLs, often your app and your login provider.
• The sign-in button does nothing when clicked.
• You see messages like:
  • "This page isn’t working"
  • "ERR_BLOCKED_BY_CLIENT"
  • "Access denied"
  • "Cookies are blocked"
  • "Please enable JavaScript to continue"
  • "Too many redirects"
• The browser developer tools (built-in page diagnostics) Console shows lines like:

Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
Refused to connect to 'https://login.example.com' because it violates the following Content Security Policy directive...
Uncaught TypeError: Cannot read properties of undefined

• The Network tab shows requests to the login domain marked "blocked" or never sent.
• Login works in another browser, another browser profile, or a private/incognito window.

Likely causes

Step-by-step diagnosis

[You] ---- 1. open /login ----> [Browser]
  |                              |
  | 2. request app login         | 3. redirect
  v                              v
[App] ---- 4. auth redirect ----> [IdP]
  ^                              |
  | 6. session cookie            | 5. login page JS/cookies
  |                              v
[Protected App] <---- 7. return ---- [Browser]

1. Open the sign-in page in a private/incognito window.

   • Chrome/Edge: browser menu → New Incognito/InPrivate Window.
   • Firefox: browser menu → New Private Window.
   • If your browser asks whether extensions can run in private mode, leave them off for this test.
   • This is your problem if: login works in the private window.
   • Jump to: "### Privacy/ad blocker is blocking login scripts or redirects" or "### Password manager or autofill extension breaks the form".

2. Try a different browser or a fresh browser profile.

   • Easiest test: open the same sign-in URL in another installed browser.
   • If you only have one browser, create a new profile from the browser profile menu and test there.
   • This is your problem if: login works in the other browser/profile but not your usual one.
   • Jump to: "### Script-blocking/security extension is blocking JavaScript or frames".

3. Disable extensions one at a time, starting with blockers.

   • Chrome/Edge: menu → Extensions → Manage Extensions.
   • Firefox: menu → Add-ons and themes → Extensions.
   • Disable these first if present: ad blocker, privacy blocker, anti-tracking, script blocker, password manager.
   • Reload the sign-in page after each change.
   • This is your problem if: the page works immediately after disabling one extension.
   • Jump to: the matching fix section below.

4. Check for blocked requests in developer tools.

   • Open the sign-in page.
   • Press:

F12

• Open the Console tab and reload the page.
• Then open the Network tab and reload again.
• This is your problem if: you see:

net::ERR_BLOCKED_BY_CLIENT

 or requests to your login domain, identity-provider domain, or `/authorize`, `/callback`, `/login`, `/sso` endpoints are blocked or missing.

• Jump to: "### Privacy/ad blocker is blocking login scripts or redirects" or "### Extension injects custom headers/content and breaks Zero Trust checks".

1. Check whether cookie blocking is breaking the sign-in handoff.

   • Browser Settings → Privacy/Security → Cookies.
   • Temporarily allow third-party cookies, or add an exception for your app domain and your login/identity-provider domain.
   • Reload the sign-in page.
   • This is your problem if: login works only after allowing cookies.
   • Jump to: "### Third-party cookie/session extension blocks identity-provider cookies".

2. If you found the extension, confirm the exact site it must allow.

   • Look at the address bar during login and note both domains, for example:

app.example.com
login.example.com

• Some Zero Trust sign-in flows use more than one domain: the app, the identity provider, and a callback URL.
• This is your problem if: the extension was disabled globally, but the page still fails when only one of the login domains remains blocked.
• Jump to: the relevant fix section and allowlist all login-related domains.

Fixes

Privacy/ad blocker is blocking login scripts or redirects

1. Open your browser's extension manager.
   • Chrome/Edge: menu → Extensions → Manage Extensions.
   • Firefox: menu → Add-ons and themes → Extensions.
2. Find the ad/privacy blocker.
3. Either disable it for the site or add these domains to its allowlist:

your app domain, for example: app.example.com
your login domain, for example: login.example.com
your identity-provider domain, if different

1. Reload the page with a hard refresh:

Ctrl+Shift+R

1. If the extension supports per-site permissions, set it to allow on those domains only instead of disabling it everywhere.

Verify it worked: the sign-in page loads without a blank screen, and developer tools no longer show ERR_BLOCKED_BY_CLIENT.

Script-blocking/security extension is blocking JavaScript or frames

1. Disable the script/security extension in:
   • Chrome/Edge: menu → Extensions → Manage Extensions.
   • Firefox: menu → Add-ons and themes → Extensions.
2. Reload the sign-in page.
3. If that fixes it, re-enable the extension and add site permissions for all login-related domains.
4. If the extension has a setting for frames/embedded login pages, allow frames for the app and login domains.

Verify it worked: the sign-in button responds, the page renders fully, and the login form appears instead of a blank or half-loaded page.

Password manager or autofill extension breaks the form

1. Disable only the password manager/autofill extension.
2. Reload the sign-in page.
3. If login now works, leave the extension enabled globally but turn it off for the affected domains in the extension's site settings.
4. If you must sign in immediately, type your username and password manually for this session instead of using autofill.

Verify it worked: the form submits normally and does not freeze, overwrite fields, or bounce back to the same page.

Third-party cookie/session extension blocks identity-provider cookies

1. Open browser cookie settings.
   • Look for: Settings → Privacy/Security → Cookies.
2. Temporarily allow third-party cookies, then test sign-in.
3. If that fixes it, remove the global change and add site exceptions for the app and login domains instead.
4. If you use a privacy extension that manages cookies separately, add the same domains to that extension's allowlist too.

Verify it worked: the redirect completes once, and you land in the app instead of seeing "Too many redirects" or returning to the login page.

Extension injects custom headers/content and breaks Zero Trust checks

1. Disable extensions that modify requests or page content, such as header editors, user-agent switchers, privacy filters, or security hardening tools.
2. Reload the page and watch the Network tab.
3. If your company provided a managed browser policy, compare the failing browser with an unmanaged browser or a clean profile.
4. If you are an admin for the identity provider or access proxy, review whether the login flow requires exact headers, cookies, or callback URLs and avoid browser-side rewrites.

Verify it worked: the /authorize, /callback, /login, or /sso requests appear in Network and return normal 200/302 responses instead of being blocked or missing.

Prevention

• Publish the exact login domains users should allowlist in blockers and privacy tools. Example internal note:

Allow these domains in browser blockers:
app.example.com
login.example.com
auth.example-idp.com

• Keep sign-in on a small, predictable set of domains. In your app config, avoid mixing many subdomains for one login flow. Example redirect settings list:

{
  "allowed_redirect_urls": [
    "https://app.example.com/callback",
    "https://portal.example.com/callback"
  ]
}

• Add a browser-based smoke test in CI (continuous integration, automated checks) that loads the login page and fails if key assets are blocked. Example Playwright check:

npx playwright test login.spec.ts

import { test, expect } from '@playwright/test';
test('login page loads', async ({ page }) => {
  const blocked = [];
  page.on('requestfailed', r => blocked.push(`${r.url()} ${r.failure()?.errorText}`));
  await page.goto('https://app.example.com/login');
  await expect(page).toHaveTitle(/Sign in/i);
  expect(blocked.filter(x => x.includes('ERR_BLOCKED_BY_CLIENT'))).toEqual([]);
});

• Add a support-ready diagnostic step to your login help page: "Try a private window with extensions disabled." Suggested copy:

If sign-in is blank, loops, or the button does nothing, open this page in a private/incognito window. If it works there, disable ad/privacy/password-manager extensions for this site.

• If you manage company devices, use browser policy to restrict risky request-modifying extensions on work profiles. In your browser management tool, allow approved extensions and block header-modifying tools on the managed profile used for company sign-in.
• Document the expected login network path so support can spot missing steps quickly:

[Browser] ---- 1. GET /login ----> [App]
[App] ---- 2. redirect ----> [IdP]
[IdP] ---- 3. set session cookie ----> [Browser]
[Browser] ---- 4. callback ----> [App]
[App] ---- 5. grant access ----> [User]

This article was written by an AI system and published pending human review. Verify anything you intend to act on.