I have created nodejs app and authenticated salesforce object. Account by nodejs app.Here is link from where I took reference https://docs.omniref.com/js/npm/nforce/0.0.2 Here is my code: Here is my server.js file:

var express = require('express');
var app = express();
var xFrameOptions = require('x-frame-options')
var server = require('http').Server(app);
var nforce = require('nforce');
var oauth;
var io = require('socket.io')(server);
var socket = io.sockets.on('connection', function (socket) { });
app.set('view engine', 'hjs');
var org = nforce.createConnection({ 
  clientId: "XXXXXX",
  clientSecret: "XXXXXX",
  redirectUri: 'XXXXXX',
  apiVersion: 'v27.0',
  environment: 'sandbox',
  mode: 'single'
app.set('port', process.env.PORT || 5005);
org.authenticate({ username: “XXX”, password: “XXX”}, function(err, resp){

    var accounts = org.query({ query: 'select Id, Name from Account limit 20' }, function(err, resp){
    if(!err && resp.records) {
        resp.records.forEach(function(account) {
    //socket.emit('news', resp);
app.get('/', function(request, response) {
     console.log('see options '+request.session);
  response.render('pages/home',{user:"John Smith"});

server.listen(app.get('port'), function() {
  console.log('Express server listening on port %d in %s mode', app.get('port'), app.get('env'));

Here is home.hjs

<html><head><title>{{ user }}</title>
  <body >  
     <div id="future"></div>
    <iframe src="https://mcnabb--devsanbox--c.cs41.visual.force.com/apex/MyCart" height="400" width="100%" frameborder="0" allowfullscreen>

I want to open the https:/XXX/apex/MyCart in the Iframe. Although authentication in server.js file is working but unable to open "https://mcnabb--devsanbox--c.cs41.visual.force.com/apex/MyCart" display in Iframe in home.hjs. Could anyone help me out in this.

  • 1
    what error are you facing? – Pranay Jaiswal Jul 4 '16 at 13:14
  • when i logged in salesforce then i am able to open the display in my app but when i logged out of salesforce i got error – user34081 Jul 5 '16 at 6:11
  • Refused to display 'mcnabb--devsanbox.cs41.my.salesforce.com/……3A%252F%252Fmcnabb--devsanbox--c.cs41.visual.force.com%252Fapex%252FMyCart' in a frame because it set 'X-Frame-Options' to 'DENY'. – user34081 Jul 5 '16 at 6:12

This is to prevent iFrame Clickjacking which is a common security threat. There might be a few things at play here.

1) The first thing I would check is that your site - https://mcnabb--devsanbox.cs41.my.salesforce.com/ is a trusted site your browser. Just make sure that it opens normally (without an iFrame).

2) If the issues are specific to iFrame, try adding target="_top" and &output=embed for your iFrame in your .hjs file

3) Make sure your Click Jack protection settings are correctly configured. This seems to be a similar issue to the one you posted.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.