6

We have a salesforce app exchange listed application. In this we are opening certain application pages in iframe. I was working fine in lightning till spring 16. We were testing our app in the new summer 16 org as the release is around the corner and we found none of our pages are opening in iframe when lightning is turned ON. Its working in the classic mode though

We found that the error we got in the browser console was of a Content Security Policy (CSP) frame-ancestors 'self'

To test this I created 2 example pagesto check what happens if I hardcode the page url and try to open in an Iframe.

When I try to open Page 1 I got an error "Refused to display 'https://cs3.lightning.force.com/one/one.app#/apex/TestFrameInternal' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'"."

Now I am confused about this content security policy as it allows iframing but only when frame-ancestor is self. I need to understand if I have understood this content security policy correctly and will I be able to open visualforce pages in iframe in lightning ui in summer 16 or not.

First Page Second Page

Improve this question
1
  • If you inspect the console errors in the browser, you'll notice some error related to frame-ancestors 'self' Check the domain and add in the 'Session Settings'(Set Up -> Quick Search['Session Settings']. For instance, if the domain is something like sandbox.force.com add the domain *force.com so it covers any sub domains.
    – Hector Moreno-Bravo
    Commented Jul 12, 2023 at 20:53

2 Answers 2

Reset to default
8

I just went through some docs and i want to share that:

1.Reason of error: See these links:

It says:

Description: Clickjacking attacks, and defenses like X-Frame-options, which are rising in popularity, are preventing iframes from being a valid way to display content. Since using an iframe is no longer possible, well give you more information on what your options are.

Resolution: Salesforce has also implemented its own defenses to "Clickjacking" attacks within the native UI. Due to this, the iFraming of Salesforce, or the iFraming of some external websites may no longer be possible. Modern browsers are forced to defend against this new kind of attack, where framing is used by malicious attackers to compromise a browser and potentially steal customer data.

Workaround: If you're encountering this problem, instead of using a web tab, a custom link can deliver the URL with the behavior set to:

Display in new window.
​Display in existing window without sidebar or header.

I haven't tested this issue myself. Probably I will give it a try and will come up with something better. Let me know if you get these points.

Improve this answer
1
  • Thanks for the reply Mr.Frodo. I understood what you want to convey. It seems opening the page in a new window might be the easiest solution although it will require a lot of change in my app. What i don't understand is the content security policy. it talks about "frame-ancestors 'self'" which means a page can be loaded in iframe if the parent's domain is the same are the page in iframe. This is confusing for me as the iframe is still not loading if I ensure the both the domains are same.
    – Sandeep Chopra
    Commented May 10, 2016 at 7:41
3

I have a compelling reason to believe this is a summer '16 bug because there are additional error messages beyond the CSP error. All VF pages even if they don't contain an Iframe generate an error indicating that a necessary header is being ignored,

Invalid 'X-Frame-Options' header encountered when loading 'https://c.gus.visual.force.com/apex/iFrame_Test_New_VF?sfdcIFrameHost=web&i…=p1&sfdcIFrameOrigin=https%3A%2F%2Fgs0.lightning.force.com&t=1462982731709': 'ALLOW-FROM https://gs0.lightning.force.com' is not a recognized directive. The header will be ignored.

This X-Frame-Options header is meant to whitelist additional salesforce domains for use within iframes. I have reported the bug to Salesforce and am awaiting a response, will update if I get confirmation.

Improve this answer
1
  • Comment from support rep: I have replicated the issue and seems to be related to summer 16 release. I will be preparing a escalation template and escalating the case to T3 team by today.
    – Boog
    Commented May 12, 2016 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .