6

We are looking to embed an external page in lightning experience. I'm trying to understand if a canvas app or an iframe is the recommended approach from a security review perspective for our use-case.

The page does not need access to any data within salesforce and there isn't any SSO between salesforce and the external application.

In the iframe approach the url would be something like the following:

https://www.example.com/index.php?token={iframe_token}

iframe_token is a one-time use token generated by the API (an apex callout would retrieve the token).

  • what did you end up using? I'm in the exact same situation. Also, were you using basic auth or oauth? We're using basic auth someone said that oauth might help. – Sabrina Gelbart Jul 27 '16 at 21:58
  • 1
    We ended up going with iframe rather than canvas app but are still in security review so no word yet. – Greg Grinberg Jul 28 '16 at 23:56
  • 1
    definitely curious how it turns out! Did you use basic auth or oauth? – Sabrina Gelbart Jul 31 '16 at 19:23
  • 1
    @RobertSösemann, This was a while ago so my memory is a bit fuzzy but it did end up passing after a lot of back and forth with the security review team. This was for a client who was presenting at DF and something of a strategic partner for Salesforce. – Greg Grinberg Jun 7 at 18:45
  • 1
    Sure. Shoot me an email at myfirstname@silverlinecrm.com – Greg Grinberg Jun 7 at 21:02
1

With the Force.com Canvas framework you get access to the connected apps . Connected apps are a way to allow third-party apps inside your system without giving them the full access rights of the end user using the app. Currently, if you build a Visualforce page and iframe , you end up sending your user session ID to the third-party app.Session ID has full access as the user, which may or may not be what you want.

The second benefit from canvas is an XHR bridge. One of the big problems with iFrames and mashup UIs is what’s called the “same origin policy.” This is a Web standard that says if you have content from one domain being displayed in a frame from another domain, the app can’t take over and make calls directly to the parent frame. This is to protect the end user because if this was allowed, an app in an iFrame could take over a user session and gain access to information that it shouldn’t be able to access. In a nutshell, this policy prevents an iFrame from communicating with its parent container

  • @Mohith...that wasn't really my question. I am trying to understand if iframe is really the correct approach or if I should go with canvas. – Greg Grinberg Jun 16 '16 at 19:44
  • I think the question is more specific to security reviews, but good explanation of why Canvas is important. – Sabrina Gelbart Jul 27 '16 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.