Having some real problems getting a Visualforce page to work with Internet Explorer 11.

I have the following Visualforce Page:

<apex:page controller="MyController">
   <iframe frameborder="0" height="800px" id="itarget" name="itarget" scrolling="auto" 
     src="https://mysite.com" title="Content" width="100%"></iframe>

If I don't add *.mydomain.com to the Trusted Sites, opening the Visualforce page shows this: enter image description here

And takes my domain\username credentials.

If I do add my domain to the Trusted Sites, and select the IE Security option for Logon to: Automatic logon with current user name and password then my current credentials work, and the iframe content loads as intended.

In either case, after taking my Windows credentials, I am able to use the functionality inside the iframe correctly. But as soon as I navigate to any other Salesforce page, it kicks me out to the login page:

enter image description here

If I log back in without closing my browser and go back to that Visualforce page, everything works, and I can navigate to other Salesforce pages just fine. But if the browser is re-opened or if I try it in a new tab, I always get kicked out of my Salesforce session.

In the IE console, running:


Shows that after navigating to that Visualforce page, my entire cookie is being destroyed, except for BrowserId. After logging back in and navigating to that Visualforce page a second time, I retain my cookie. Chrome does not have this issue, and does not destroy my cookie after Windows Authentication.

I've tried almost every setting in IE, but I can't get the browser to allow this iframe without ending my session.

  • It's likely not an HTTP/HTTPS issue: the src= can be changed to an external http or https site and the iframe works. It's only with Windows Authentication that it breaks.
  • It's likely not an issue with P3P headers: in the above situation, IE still renders the iframe and doesn't end the session even with P3P errors in IE View-->Security Report. Using Fiddler, I can see there's some MALFORMED P3P errors on my salesforce login screen, but that happens without touching my visualforce page.
  • I added mysite.com as a Remote Site, and Disabled Protocol Security.

I say 'likely' because I'm new at Salesforce. Any help would be appreciated.

  • This is a great question. Did you ever find the answer? Perhaps somehow using localStorage can preserve the session. Here's a video tutorial on local storage: youtube.com/watch?v=W8s-LcXU-io – Eric Hepperle - CodeSlayer2010 Dec 5 '18 at 11:00
  • 1
    Unfortunately for anyone else stumbling upon this post, the cause of my particular problem was due to: 1) Some obscure Active Directory groups that users were a member of, with some settings allowing iframes, others preventing them. 2) Some of these AD group settings had higher priority than local settings, leading to false negatives when attempting to fix it. – postapollo Dec 6 '18 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.