I am trying to iFrame a site external to Salesforce into a Communities page and I'm receiving the expected error of "Refused to display '[URL link]' in a frame because it set 'X-Frame-Options' to 'sameorigin'."

This Salesforce document: https://help.salesforce.com/articleView?id=000003366&type=1 and a few other forum posts that I found say that iFraming into Salesforce is everything from not recommended to almost impossible. A few posts used workarounds that may make a security department queasy.

Basically, I have a simple Lightning Component with an iframe tag:

<aura:component implements="flexipage:availableForAllPageTypes,forceCommunity:availableForAllPageTypes" access="global" >
<iframe width="800" height="600" style="border: 1px solid" src="[URL]" />

I put this component into a Community page and the iframe just shows up blank with the X-frame options error. Now, would this work even work with the X-frame options altered? Or are there larger issues with iFraming in Salesforce Communities that I have yet to discover? I guess I'm trying to determine if this is no longer possible - i.e., has Salesforce locked iFraming down?


I confirmed that this is indeed possible through a POC - the component I described above displayed the page as expected with a "contentOnly" flag set. The owners of the framed website just needed to adjust their webconfigs to allow the iFraming.

  • contentOnly flag on where ? @ewomack ? – user2945545 Sep 26 '18 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.