I faced with such issue, that canvas app displays web applications not from all specified URLs (I use visualforce page to display canvasApp). For example, i can't display facebook.com main page, but i can display Jira home page. What could be causing such a problem? How might I investigate and resolve this issue?
I guess you are trying to display another site inside a frame or iframe. There is a way to forbid this using the HTTP-Header
X-Frame-Options, which is set to
DENY on facebook.com for example. So this site cannot be displayed in a frame as facebook doesn't like you to do so.
However, there is a dirty workaround for this, which SHOULD NOT be used. This includes proxying the website through a reverse proxy like nginx and removing the
More information can be found in the Open Web Application Security Project - Clickjacking Defense Cheat Sheet.