I had/have a Visualforce page that displays an iframe that points to another page within my organization. It points to the page that renders an email template (like https://prodorg--c.na17.content.force.com/email/templaterenderer?id=00Xo0000000qhjUEAQ&recipient_type_id=003o000000rkJIKAA2&related_to_id=a00o000000uGVSE
).
I had to do a little tweak on the page, but didn't change the iframe section. Once I deployed the change set in production (NA17) the iframe stopped working, but it still works on sandbox (CS22 instance).
I don't get it. I've done some research and I read about clickjacking, and how Salesforce started to enable some headers by default that would prevent loading external pages or something like that. But hey, my page works on sandbox and not on production? And all updates are applied to both, so I don't see why the page won't load on production.
Now I get the error message (on Chrome's console):
Refused to display 'https://login.salesforce.com/?ec=302&startURL=%2Fcontent%2Fsession%3Furl%3D…%2526preview_frame%253DcontentFrame%2526render_type%253DREPLACED_HTML_BODY' in a frame because it set 'X-Frame-Options' to 'DENY'.