0

I am trying to build a simple visualforce page with an iframe.

my page:

<apex:page>
    <apex:iframe src="http://my.website.com" scrolling="true" id="theIframe"/>
</apex:page>
  • ("my.website.com" is a placeholder name for this question)

i have added the url to the "remote site settings" and checked the "Disable Protocol Security" box. When trying to preview the page i get a blank page and the following errors:

  1. Content Security Policy: Referrer Directive ‘origin-when-cross-origin’ has been deprecated. Please use the Referrer-Policy header instead.

  2. Blocked loading mixed active content “http://my.website.com/”

  3. Content Security Policy: Not supporting directive ‘reflected-xss’. Directive and values will be ignored.

Can anyone shed some light on what i need to do next in order to get the iframe to display in my page?

Improve this question
3
  • You have to set X-Frame-Options in header in the webpages in my.website.com . Salesforce setting won't work.
    – Saroj Bera
    Commented Apr 25, 2017 at 13:02
  • Adding "Header always unset X-Frame-Options" to the ".htaccess" file in my "public_html" folder did the trick. If you want to add this as an answer i can mark it as correct
    – RealGigex
    Commented Apr 25, 2017 at 14:39
  • Glad it worked out for you. I have added my comments as an answer.
    – Saroj Bera
    Commented Apr 26, 2017 at 5:11

1 Answer 1

Reset to default
0

This is not an issue with Salesforce platform. You have to set X-Frame-Options in the header in the web pages in my.website.com. Salesforce setting won't work for this issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .