I have created nodejs app and authenticated salesforce object. Account by nodejs app.Here is link from where I took reference https://docs.omniref.com/js/npm/nforce/0.0.2 Here is my code: Here is my server.js file:

var express = require('express');
var app = express();
var xFrameOptions = require('x-frame-options')
var server = require('http').Server(app);
var nforce = require('nforce');
var oauth;
var io = require('socket.io')(server);
var socket = io.sockets.on('connection', function (socket) { });
app.set('view engine', 'hjs');
var org = nforce.createConnection({ 
  clientId: "XXXXXX",
  clientSecret: "XXXXXX",
  redirectUri: 'XXXXXX',
  apiVersion: 'v27.0',
  environment: 'sandbox',
  mode: 'single'
app.set('port', process.env.PORT || 5005);
org.authenticate({ username: “XXX”, password: “XXX”}, function(err, resp){

    var accounts = org.query({ query: 'select Id, Name from Account limit 20' }, function(err, resp){
    if(!err && resp.records) {
        resp.records.forEach(function(account) {
    //socket.emit('news', resp);
app.get('/', function(request, response) {
     console.log('see options '+request.session);
  response.render('pages/home',{user:"John Smith"});

server.listen(app.get('port'), function() {
  console.log('Express server listening on port %d in %s mode', app.get('port'), app.get('env'));

Here is home.hjs

<html><head><title>{{ user }}</title>
  <body >  
     <div id="future"></div>
    <iframe src="https://mcnabb--devsanbox--c.cs41.visual.force.com/apex/MyCart" height="400" width="100%" frameborder="0" allowfullscreen>

I want to open the https:/XXX/apex/MyCart in the Iframe. Although authentication in server.js file is working but unable to open "https://mcnabb--devsanbox--c.cs41.visual.force.com/apex/MyCart" display in Iframe in home.hjs. Could anyone help me out in this.

  • 1
    what error are you facing? Commented Jul 4, 2016 at 13:14
  • when i logged in salesforce then i am able to open the display in my app but when i logged out of salesforce i got error
    – user34081
    Commented Jul 5, 2016 at 6:11
  • Refused to display 'mcnabb--devsanbox.cs41.my.salesforce.com/……3A%252F%252Fmcnabb--devsanbox--c.cs41.visual.force.com%252Fapex%252FMyCart' in a frame because it set 'X-Frame-Options' to 'DENY'.
    – user34081
    Commented Jul 5, 2016 at 6:12

1 Answer 1


This is to prevent iFrame Clickjacking which is a common security threat. There might be a few things at play here.

1) The first thing I would check is that your site - https://mcnabb--devsanbox.cs41.my.salesforce.com/ is a trusted site your browser. Just make sure that it opens normally (without an iFrame).

2) If the issues are specific to iFrame, try adding target="_top" and &output=embed for your iFrame in your .hjs file

3) Make sure your Click Jack protection settings are correctly configured. This seems to be a similar issue to the one you posted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .