1

I'm developing a Lightning Component in which I'd like to re-use some functionality I have developed and hosted externally. I created an iframe to display that functionality, and was expecting to be able to use parent.postMessage() to be able to communicate back to the host Lightning Component which registers an event listener on the window. To test, I've referenced the component in a standalone Lightning App (which is how I expect the component to be used- not in tabs/pages in Salesforce).

However, when I do so, I get an error of the form:

Uncaught SecurityError: Blocked a frame with origin "https://...-dev-ed.lightning.force.com" from accessing a cross-origin frame.
throws at https://...-dev-ed.lightning.force.com/auraFW/javascript/aFPQVaW6aCRCwKFhEzY2OA/aura_prod.js:545:476

Note that this only occurs from iframe to parent, not the other way around. In the controller for my Lightning component, I can get a reference to the iframe contentWindow and successfully postMessage into the iframe.

Is this expected behavior for Lightning Apps- that they can communicate to iframes via postMessage, but they cannot receive replies back (via postMessage in the iframe to parent)?

Improve this question
3
  • 1
    Please show your code, as the security error has nothing to do with postMessage.
    – Robert Sussland
    Commented Nov 19, 2016 at 3:51
  • @RobertSussland well, I went back to my code today to try and strip it down to the minimum needed to demonstrate the error and... well, I can't reproduce it today. No changes to my code, but it is now working- an update pushed out to the Aura library perhaps in the meantime? It may not look like a postMessage related error, but at the time it was definitely being caused after script in my iframe called parent.postMessage(...) to send a message back to the parent lightning app component.
    – Francis Li
    Commented Nov 21, 2016 at 1:39
  • Well, I'm not saying you didn't see the error after calling postMessage, only that postMessages aren't going to generate the SOP violation that is being reported. This error would be thrown only if code in one frame tried to access the DOM of another frame with a different origin. That's why I wanted to see the full code. If you see it again, please post the steps to reproduce.
    – Robert Sussland
    Commented Nov 21, 2016 at 12:00

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .