Are external iframes in lightning experience kosher from a security review perspective?

Question

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case.

The page does not need access to any data within salesforce and there isn't any SSO between salesforce and the external application.

In the iframe approach the url would be something like the following:

https://www.example.com/index.php?token={iframe_token}

iframe_token is a one-time use token generated by the API (an apex callout would retrieve the token).

Answer 1

With the Force.com Canvas framework you get access to the connected apps . Connected apps are a way to allow third-party apps inside your system without giving them the full access rights of the end user using the app. Currently, if you build a Visualforce page and iframe , you end up sending your user session ID to the third-party app.Session ID has full access as the user, which may or may not be what you want.

The second benefit from canvas is an XHR bridge. One of the big problems with iFrames and mashup UIs is what’s called the “same origin policy.” This is a Web standard that says if you have content from one domain being displayed in a frame from another domain, the app can’t take over and make calls directly to the parent frame. This is to protect the end user because if this was allowed, an app in an iFrame could take over a user session and gain access to information that it shouldn’t be able to access. In a nutshell, this policy prevents an iFrame from communicating with its parent container