I am struggling with a error when i am trying to display a page of external application in an i-frame using tag due to an error X-frame Options Set to Deny .I have attached the screenshot of issue i am facing.

enter image description here

Added the Error message below

Refused to display 'https://cs7.salesforce.com/setup/secur/RemoteAccessAuthorizationPage.apexp?…2AT507VHCMCEBC6dt017Ii704n6BtQEWIoUCWgsAtW4q7Zb73sauUcLJLEvKg%3D%3D&sdtd=1' in a frame because it set 'X-Frame-Options' to 'DENY'.

The external app page on first load need to get oauth with sfdc and hence sfdc standard oauth screen to allow or deny should render but due to this security protection(Protection from click-hijacking) from sfdc servers i am unable to display this on iframe .

Any solutions on bypassing this?

  • I'm getting this response with a Canvas app and OAuth Web Flow, and the response says reload to authenticate. Reloading the url inside the response gets me the OAuth Accept/Reject page, but I don't know why I'm not getting that in the first place. I don't know if that's relevant to your question. – freyley Jan 23 '14 at 17:50


If you need the page embedded, then the only solution to the X-Frame-Option is to get your domain white-listed. If you can load the page without embedding or in a new window you will not have this problem.

| improve this answer | |
  • No i use oauth .I think i need to get business approved to use this mechanism but not in iframe.It errors out only in Iframe . – Mohith Shrivastava Aug 19 '13 at 18:26
  • Can you show the auth screen in a new window? Or just not in an iFrame? – Mike Chale Aug 19 '13 at 18:38
  • That will solve the issue but client is very paticular about showing in iframe .Sadly :( – Mohith Shrivastava Aug 19 '13 at 19:04
  • Unfortunately it really is technically impossible. Unless your client convinces Salesforce to make an exception. – Mike Chale Aug 19 '13 at 19:10

The issue is that you are trying to embed a salesforce.com login/oauth page in the canvas frame, which is not allowed. The only way to perform the salesforce OAuth flow would be to eject into a new window, or into a popup window (the Canvas Documentation shows how to run the oauth flow correctly).

The other option you have would be to use the signed request access method, which will deliver to your side the access tokens on the first POST to your side, as opposed to having you manually do the flow.

Hope this helps. Jay

| improve this answer | |
  • 2
    Thanks for taking time and spending time on stackexchange .Really appreciate – Mohith Shrivastava Jul 28 '14 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.