I've got a connected app that handles login through the Oauth 2.0 webserver flow, and was originally designed to run in the web browser outside of the salesforce ui. We still want it to be able to function separately, but we recently got a request to also add the app to the salesforce ui. Our idea was to use a url tab with a link to the app, but unfortunately requests for
https://ap4.salesforce.com/setup/secur/RemoteAccessAuthorizationPage.apexp?source=... are sending a response back with a
X-FRAME-OPTIONS:DENY header that is blocking the authorization page from being displayed in the salesforce ui.
Currently the connected app is set up so that users can self-authorize, and interestingly, we are only running into the problem when users attempt to first authorize the app through the salesforce ui. If a user has already previously hit allow through the stand-alone app, the redirect from
https://ap4.salesforce.com/setup/secur/RemoteAccessAuthorizationPage.apexp?source= will return without an
X-FRAME-OPTIONS header set.
I'm not sure why they didn't set the header to
SAMEORIGIN, but I have a feeling that there's no way for us to change that.
Anyways, I guess my question is:
What's the easiest way to get an existing connected app displayed in the ui?