I faced with such issue, that canvas app displays web applications not from all specified URLs (I use visualforce page to display canvasApp). For example, i can't display facebook.com main page, but i can display Jira home page. What could be causing such a problem? How might I investigate and resolve this issue?

  • If my answer helped, please mark it as accepted. Thank you! – Markus Slabina Jul 18 '17 at 15:11

I guess you are trying to display another site inside a frame or iframe. There is a way to forbid this using the HTTP-Header X-Frame-Options, which is set to DENY on facebook.com for example. So this site cannot be displayed in a frame as facebook doesn't like you to do so.

However, there is a dirty workaround for this, which SHOULD NOT be used. This includes proxying the website through a reverse proxy like nginx and removing the X-Frame-Options header.

More information can be found in the Open Web Application Security Project - Clickjacking Defense Cheat Sheet.

Not the answer you're looking for? Browse other questions tagged or ask your own question.