6

When I try to include the following VF page into the layout: 

<apex:page standardController="Account">
    <h1>Hi</h1>
</apex:page>

I get the "URL no longer exists" error when the record detail view opens:

The error is a known salesforce behavior that is related to the clickjacking feature. See this Knowledge Article 000230608. The only solution offered is the deactivation of the clickjacking feature. But when I deactivate the feature it is considered a "high risk" in the security audit and under "Critical Updates" it is marked for auto-activation in 30 days.

So my question is: How can I create an inline VF page without deactivating clickjacking?

The specific clickjacking options are: "Enable clickjack protection for customer Visualforce pages with standard headers" or "Enable clickjack protection for customer Visualforce pages with headers disabled".

I simply can not believe that there is no workaround for this issue, a lot of apps and packages rely on inline VF pages, will they all stop working when this feature is auto-enabled? Is inline VF deprecated and should no longer be used?

Improve this question
2
  • 1
    What about setting showHeader = "false" as one of the solution mentioned in the link?
    – javanoob
    Jan 11, 2017 at 13:25
  • Nope, still the same error. I tried both "Enable clickjack protection for customer Visualforce pages with standard headers" and "Enable clickjack protection for customer Visualforce pages with headers disabled". With showHeader = "false", applyHtmlTag="true", applyHtmlTag="false", basically every combination I could think of, it does only work if I disable one of these two options
    – Frank
    Jan 11, 2017 at 13:30

1 Answer 1

Reset to default
3

The first option for resolution is far preferable:

The issue occurs with standard headers. If your Visualforce page does not require headers then you can set the showHeader attribute to false which should resolve the issue:

 <apex:page standardController="SObject" showHeader="false">

In API Version 38, the above attribute no longer fixes the error, but apparently in versions 37 and under, it still works.

EDIT

The linked document has been updated:

3) In API version 38 and above if Enable clickjack protection for customer Visualforce pages with headers disabled (added in Summer '16) is enabled your Visualforce page will also need to set applyHtmlTag attribute to false.

<apex:page standardController="SObject" showHeader="false" applyHtmlTag="false">
Improve this answer
5
  • Does only work when I disable "Enable clickjack protection for customer Visualforce pages with headers disabled"
    – Frank
    Jan 11, 2017 at 13:33
  • If you're getting it with a page that has showHeader="false" then I think that's a bug.
    – Adrian Larson ♦
    Jan 11, 2017 at 13:34
  • 1
    showHeader="false" works when I change the API Version from 38 to 37. So it could be a bug or the security settings have changed, I will report it to salesforce and accept your answer when it got fixed.
    – Frank
    Jan 11, 2017 at 13:49
  • Good find! Here's hoping it is not permanent.
    – Adrian Larson ♦
    Jan 11, 2017 at 14:03
  • I am facing similar issue with detail button. Did you come across VF pages which is opened through a detail button? There is no error, the page is blank. I tried with version 37, no luck. For my further trouble shooting I created a very basic page with just a sentence.
    – goabhigo
    Jan 31, 2017 at 5:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .