10

I have an VF page with an iframe displaying a force.com site from a different SF instance and I'm receiving this error in chrome caused by SfdcCore.js:

Blocked a frame with origin "https://<mysitename>.<mycompanyname>.cs10.force.com" from accessing a frame with origin "https://<namespace>.na15.visual.force.com". Protocols, domains, and ports must match.

Everything seems to be functioning normally except the javascript error is preventing any further javascript from running correctly.

Has anyone found any type of workaround for this?

Improve this question
9
  • 1
    I wonder if this is related to the fact that Salesforce sandboxes don't have valid SSL certs.
    – greenstork
    Commented Oct 3, 2013 at 16:25
  • Yeah I kinda hope that might be case, I'll be able to test when I push the force.com site to production. I've had that remedy the SSL warning before, but I'm concerned this might be a separate issue, even if the protocols match the domains won't.
    – Phil B
    Commented Oct 3, 2013 at 16:28
  • 2
    Same problem with a solution stackoverflow.com/questions/11552514/…
    – Phil Rymek
    Commented Oct 3, 2013 at 16:35
  • 3
    Your domains don't match; you're going from cs10.force.com to na15.visual.force.com. Seems like a basic security feature.
    – Mike Chale
    Commented Oct 3, 2013 at 16:47
  • 2
    iframing is allowed from one domain to another, Mike Chale, it's having some code in the iframe access the parent page that is not allowed.
    – greenstork
    Commented Oct 3, 2013 at 16:54

1 Answer 1

Reset to default
7

Domain of parent page and the its origined iframe page must be same to access parent frame javascript from child frame javascript or jquery. This is a basic security feature which prevents javascript injection from cross-domain sites.

Even if your domain is same and one is using https:// and its child frame using http:// javascript will not work because protocol is different. No browser support cross-domain referencing. Its a browser security feature.

Only solution is redirecting the page through controller using Pagereference when you have done something on page or use same domain.

Edit (found a useful link):

Explained in more detail - http://javascript.info/tutorial/same-origin-security-policy

Improve this answer
6
  • 1
    There is a workaround for this. You could use postMessage (developer.mozilla.org/en-US/docs/Web/API/Window.postMessage) to send data across pages of different domain. But unfortunately it doesn't work that well in IE..
    – Sam
    Commented Oct 8, 2013 at 8:36
  • I believe JSONP could also be used as a workaround.
    – Phil B
    Commented Dec 9, 2014 at 15:13
  • @PhilB JSONP and PostMessaging would work.
    – Ashwani
    Commented Dec 12, 2014 at 6:53
  • @PhilB Can you give some information about how to use JSONP in salesforce.
    – Monish
    Commented May 10, 2016 at 12:02
  • @ Anamadeya - I tried but its not working. Since I dont have access to the IFrame in salesforce. How we can make this working ?
    – user4567570
    Commented Nov 3, 2017 at 14:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .