10

I have an VF page with an iframe displaying a force.com site from a different SF instance and I'm receiving this error in chrome caused by SfdcCore.js:

Blocked a frame with origin "https://<mysitename>.<mycompanyname>.cs10.force.com" from accessing a frame with origin "https://<namespace>.na15.visual.force.com". Protocols, domains, and ports must match. 

Everything seems to be functioning normally except the javascript error is preventing any further javascript from running correctly.

Has anyone found any type of workaround for this?

9
  • 1
    I wonder if this is related to the fact that Salesforce sandboxes don't have valid SSL certs.
    – greenstork
    Oct 3 '13 at 16:25
  • Yeah I kinda hope that might be case, I'll be able to test when I push the force.com site to production. I've had that remedy the SSL warning before, but I'm concerned this might be a separate issue, even if the protocols match the domains won't.
    – Phil B
    Oct 3 '13 at 16:28
  • 2
    Same problem with a solution stackoverflow.com/questions/11552514/…
    – Phil Rymek
    Oct 3 '13 at 16:35
  • 3
    Your domains don't match; you're going from cs10.force.com to na15.visual.force.com. Seems like a basic security feature.
    – Mike Chale
    Oct 3 '13 at 16:47
  • 2
    iframing is allowed from one domain to another, Mike Chale, it's having some code in the iframe access the parent page that is not allowed.
    – greenstork
    Oct 3 '13 at 16:54
7

Domain of parent page and the its origined iframe page must be same to access parent frame javascript from child frame javascript or jquery. This is a basic security feature which prevents javascript injection from cross-domain sites.

Even if your domain is same and one is using https:// and its child frame using http:// javascript will not work because protocol is different. No browser support cross-domain referencing. Its a browser security feature.

Only solution is redirecting the page through controller using Pagereference when you have done something on page or use same domain.

Edit (found a useful link):

Explained in more detail - http://javascript.info/tutorial/same-origin-security-policy

6
  • 1
    There is a workaround for this. You could use postMessage (developer.mozilla.org/en-US/docs/Web/API/Window.postMessage) to send data across pages of different domain. But unfortunately it doesn't work that well in IE..
    – Sam
    Oct 8 '13 at 8:36
  • I believe JSONP could also be used as a workaround.
    – Phil B
    Dec 9 '14 at 15:13
  • @PhilB JSONP and PostMessaging would work.
    – Ashwani
    Dec 12 '14 at 6:53
  • @PhilB Can you give some information about how to use JSONP in salesforce.
    – Monish
    May 10 '16 at 12:02
  • @ Anamadeya - I tried but its not working. Since I dont have access to the IFrame in salesforce. How we can make this working ? Nov 3 '17 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.