I am trying to iFrame a site external to Salesforce into a Communities page and I'm receiving the expected error of "Refused to display '[URL link]' in a frame because it set 'X-Frame-Options' to 'sameorigin'."

This Salesforce document: https://help.salesforce.com/articleView?id=000003366&type=1 and a few other forum posts that I found say that iFraming into Salesforce is everything from not recommended to almost impossible. A few posts used workarounds that may make a security department queasy.

Basically, I have a simple Lightning Component with an iframe tag:

<aura:component implements="flexipage:availableForAllPageTypes,forceCommunity:availableForAllPageTypes" access="global" >
<iframe width="800" height="600" style="border: 1px solid" src="[URL]" />

I put this component into a Community page and the iframe just shows up blank with the X-frame options error. Now, would this work even work with the X-frame options altered? Or are there larger issues with iFraming in Salesforce Communities that I have yet to discover? I guess I'm trying to determine if this is no longer possible - i.e., has Salesforce locked iFraming down?

1 Answer 1


I confirmed that this is indeed possible through a POC - the component I described above displayed the page as expected with a "contentOnly" flag set. The owners of the framed website just needed to adjust their webconfigs to allow the iFraming.

  • 1
    contentOnly flag on where ? @ewomack ? Sep 26, 2018 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .