9

Scenario : I have built desktop based Force.com platform and now i have enabled the Salesforce 1 Mobile app on my environment. Now if i try to load the same Desktop based Quote Detail page on Iphone 5 emulator on Google Chrome, i get this error

: [Report Only] Refused to frame 'https://c.na10.visual.force.com/apex/QuoteDetail?id=a0RF000000IYFfjMAH&sfdcIFrameOrigin=https%3A%2F%2Fna10.salesforce.com&isdtp=p1&sfdcIFrameHost=web' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.

Please if some one could help me figure out the reason. Really appreciate it

From the comments, here is the quote detail page:

<apex:page standardController="Quote__c" title="Quote Detail" sidebar="false">
    <apex:form >
        <c:QuoteDetail theQuoteId="{!Quote__c.Id}" />
    </apex:form>
</apex:page>
Improve this question
6
  • Yes sure, but it is going to be long. I have a QuoteDetail.page, QuoteDetail.component which is embedded in the QuoteDetail.page and QuoteDetail.controller. As well as QuoteDetail.css file. I will attach the QuoteDetail.page and QuoteDetail.component
    – user10684
    Commented Jul 28, 2014 at 22:53
  • I am unable to add the code as it says out of space for characters
    – user10684
    Commented Jul 28, 2014 at 22:55
  • Can you create a smallest possible VF page that still reproduces the error then :) We certainly don't want to read pages and pages of your logic...
    – eyescream
    Commented Jul 28, 2014 at 22:56
  • QuoteDetail.page <apex:page standardController="Quote__c" title="Quote Detail" sidebar="false"> <apex:form > <c:QuoteDetail theQuoteId="{!Quote__c.Id}" /> </apex:form> </apex:page>
    – user10684
    Commented Jul 28, 2014 at 22:57
  • The QuoteDetail i.e <c:QuoteDetail> is a custom made component within the application. Any thoughts as to what might be causing the error
    – user10684
    Commented Jul 28, 2014 at 23:17

1 Answer 1

Reset to default
1

You are seeing this error due to a Content Security Policy (CSP) breach - a CSP is an HTTP header that defines a bunch of policies for resources. You are falling foul of the frame-src restriction. You can read more about this at:

http://www.html5rocks.com/en/tutorials/security/content-security-policy/

If the iphone5 emulator you are using is a chrome app, the default behaviour for those is to disallow external resources in iframes:

https://developer.chrome.com/apps/contentSecurityPolicy (search for frame-src).

If you don't have a real device I would use the desktop version of Salesforce1 (/one/one.app) with the browser resized appropriately.

Improve this answer
1
  • I am also running into the same "Content Security Policy directive: "default-src 'self'" error. I am attempting show google maps in a lightning component, I tried switching to "<webview" instead of Iframe but with no luck. Can anyone advise an easy way to whitelist an address for use in lightning components or other solution?
    – nickforce
    Commented Oct 20, 2014 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .