12

Here are the steps to reproduce on a Winter 13 sandbox:

Create the following VisualForce component called TestClickJackComponent:

<apex:component >
<!-- Begin Default Content REMOVE THIS -->
<h1>Congratulations</h1>
This is your new Component
<!-- End Default Content REMOVE THIS -->
</apex:component>

Create the following VisualForce page called TestClickJack:

<apex:page StandardController="Lead">
<!-- Begin Default Content REMOVE THIS -->
<h1>Congratulations</h1>
This is your new Page
<!-- End Default Content REMOVE THIS -->
<c:TestClickJackComponent />
</apex:page>

Add the page to your lead page layout. You'll see:

Congratulations This is your new Page Congratulations This is your new Component

Now go to Enable Setup-Security Controls – Session Settings and select Enable clickjack protection for non-setup customer Visualforce pages

Now you'll see:

URL No Longer Exists You have attempted to reach a URL that no longer exists on salesforce.com.

So, my question is - is this a bug? Or is it expected behavior with the new clickjacking protection?

  • I just discovered it doesn't even have to be a component. This flat out prevents use of any custom VisualForce page on a page layout. Can this really be expected behavior? – kibitzer Sep 12 '12 at 6:53
  • HOLY @#&! What a horrible feature. I feared this behavior when I posted my question a little bit back. This feature is DOA, if any Salesforce people are reading this PLEASE try to put the brakes on this feature! – jkraybill Sep 13 '12 at 2:02
6

Have received further reliable information from Salesforce.

This is the expected behavior, at least for now. They will be looking into it further.

The workaround is to be sure to set ShowHeader = false on the page tag for the VisualForce page.

From my perspective, the real failure here is in communication. A failure to make it very clear in the documentation and release notes that this problem does apply to Visual Force pages on page layouts, a failure to clearly document the workaround (it's not even mentioned in the release notes), a failure to give organizations and ISVs lead time that this issue was coming so they'd have time to validate code and put in the necessary updates before user's turn on this feature an go into a panic when everything breaks. A failure of the support organization (I opened a case and got back that this was a "feature" - but without any note of the workaround).

2

I would assume with click-jacking that SFDC URLs are white-listed. However, because all browsers enforce cross origin policies, click jacking should only be an issue between pages on the same domain and iframe.

However, it could be that standard pages are on a different domain than custom VF page domain.

So, I just did something similar, dropped a VF page with a standard controller Lead onto the lead layout:

Enable clickjack protection for non-setup Salesforce pages - no issues

Enable clickjack protection for non-setup customer Visualforce pages - same error: URL doesn't exist.

Seems like the 2nd option (checked with or without both) causes this error: So it looks like it's stopping the iframe from accessing VF pages when the 2nd option is checked, which I would assume is the expected behavior

  • 2
    I just found it doesn't even have to involve a component. This prevents use of VisualForce pages on page layouts - period. Can that really be the plan? – kibitzer Sep 12 '12 at 6:54
  • 1
    That would break a lot of Apps! I don't think that's the intended purpose. So you tried removing the component? – jordan.baucke Sep 12 '12 at 6:55
  • 1
    Right - it fails even without the component on the page. I'm sure hoping it's a bug - that would be a huge breaking change. – kibitzer Sep 12 '12 at 6:59
  • Fairly certain, after reading the docs and getting some feedback, that this is intended and not a bug. It's more like a facepalm feature. Hopefully will be used only by stone age customers? – jkraybill Sep 25 '12 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.