2

I have a canvas app integrated to Salesforce. When I launch my canvas app the URL of the browser changes to myapp/xyz/abc. Earlier it was my Salesforce domain URL. Is there a way to not show the change in the URL to my user. I do not wish my user to see that we are using an external app.

I checked the link - https://developer.salesforce.com/docs/atlas.en-us.platform_connect.meta/platform_connect/canvas_controlling_app_behavior.htm where it says I can use - setCanvasUrlPath(newPath) to set the path of the url but can not change the domain name. Is there any work around where I can switch back the canvas app url to my Salesforce domain url?

Improve this question
4
  • At a guess, I'd say the domain is locked for security reasons. This would help restrict access to cookies etc...
    – Daniel Ballinger
    Commented Apr 5, 2016 at 20:46
  • Why would access to cookies will be restricted? I mean what is the purpose of using a restriction there. Usually if it is hosted on web, application would have access to the cookies right?
    – SfdcBat
    Commented Apr 5, 2016 at 23:48
  • 1
    Salesforce are protective of the cookies that get set within their domain. There are be details there that a canvas app should not get access to. E.g If an admin is logged in as as another user both session ids could be in the cookies. In a similar area, Apex can only access cookies with a given prefix. It doesn't have carte blanche access to whatever cookies are present.
    – Daniel Ballinger
    Commented Apr 5, 2016 at 23:53
  • Thanks, Please let me know if I can accept this as an answer or wait for some one to confirm this as an answer.
    – SfdcBat
    Commented Apr 6, 2016 at 0:11

1 Answer 1

Reset to default
1

I'll go out a limb here and say they you can't do this for security reasons.

Having your canvas app in a different domain prevents you from accessing cookies the Salesforce may want to protect. There are standard Salesforce cookies that you should have access to. For instance, if an administrator has used the "login as" functionality there can be addition cookies that link back to their original session id. Similar arguments could also be made about JavaScript code in your Canvas app.

This will have strong parallels to why Visualforce pages are on different domains - Why are visualforce pages served from a different domain?

The move to separate domains has one very specific purpose: leverage the browser security model (same domain policy) to protect our customers and the salesforce.com service from cross site scripting and cross site request forgery attacks.

Moving to the serving pages from separate domains is a critical component of our ongoing commitment to insure the highest level of security and availability for everyone.

In the world where everything is served from the same domain any custom page that you visit had full access to any other page in your org and also any page served from salesforce.com itself. This included potentially malicious code that was installed as part of a force.com package.

Source

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .