We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case.

The page does not need access to any data within salesforce and there isn't any SSO between salesforce and the external application.

In the iframe approach the url would be something like the following:


iframe_token is a one-time use token generated by the API (an apex callout would retrieve the token).

  • what did you end up using? I'm in the exact same situation. Also, were you using basic auth or oauth? We're using basic auth someone said that oauth might help. Jul 27, 2016 at 21:58
  • 1
    We ended up going with iframe rather than canvas app but are still in security review so no word yet. Jul 28, 2016 at 23:56
  • 1
    definitely curious how it turns out! Did you use basic auth or oauth? Jul 31, 2016 at 19:23
  • 1
    @RobertSösemann, This was a while ago so my memory is a bit fuzzy but it did end up passing after a lot of back and forth with the security review team. This was for a client who was presenting at DF and something of a strategic partner for Salesforce. Jun 7, 2019 at 18:45
  • 1
    Sure. Shoot me an email at [email protected] Jun 7, 2019 at 21:02

1 Answer 1


With the Force.com Canvas framework you get access to the connected apps . Connected apps are a way to allow third-party apps inside your system without giving them the full access rights of the end user using the app. Currently, if you build a Visualforce page and iframe , you end up sending your user session ID to the third-party app.Session ID has full access as the user, which may or may not be what you want.

The second benefit from canvas is an XHR bridge. One of the big problems with iFrames and mashup UIs is what’s called the “same origin policy.” This is a Web standard that says if you have content from one domain being displayed in a frame from another domain, the app can’t take over and make calls directly to the parent frame. This is to protect the end user because if this was allowed, an app in an iFrame could take over a user session and gain access to information that it shouldn’t be able to access. In a nutshell, this policy prevents an iFrame from communicating with its parent container

  • @Mohith...that wasn't really my question. I am trying to understand if iframe is really the correct approach or if I should go with canvas. Jun 16, 2016 at 19:44
  • I think the question is more specific to security reviews, but good explanation of why Canvas is important. Jul 27, 2016 at 22:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .