Question for you Lightning-and-Communities-savvy developer-ish folks here.

I'm trying to get a legacy VF page wrapped within a Lightning component via an iframe in a community page, and failing: when a community user logs in and accesses the page, the iframe is empty, and there is this error in the Firefox console:

Load denied by X-Frame-Options: https://apsona-ltng1-dev-ed.my.salesforce.com/?ec=302&startURL=%2Fapex%2FHelloWorldPage%3Fparam%3DTestParameterValue does not permit framing.

In trying to find the root cause, I built a very basic component and VF page. Below is the only file of the component in it that contains anything at all:

<aura:component implements="force:appHostable,flexipage:availableForAllPageTypes,flexipage:availableForRecordHome,force:hasRecordId,forceCommunity:availableForAllPageTypes,force:lightningQuickAction" access="global" >

<h2>This is from the Lex component.</h2>

<iframe style="border: 0; width: 400px; height: 400px;" src="https://apsona-ltng1-dev-ed.my.salesforce.com/apex/HelloWorldPage?param=TestParameterValue"></iframe>

And below is the entire VF page in question:

<apex:page docType="html-5.0" applyHtmlTag="false" 
applyBodyTag="false" showHeader="false" sidebar="false" standardStylesheets="false" 
title="Unused Title"> 
<html> <body> <h1>Hello, world!</h1> 
Parameter value: "{!$CurrentPage.parameters.param}" 
</body> </html> 

Oddly enough, if I just drop the VF page directly onto the page (i.e., not wrapped in a Lightning component), it works fine, but then I cannot build a UI around it to pass user parameters to it.

Also, If I view the page with the component in it as an admin, it works fine. It's only the end-user (the most important person in this chain!) that has issues.

I saw a few pages on StackOverflow and success.salesforce.com indicating that I need to include the community name in the iframe URL, and tried several variations of it. But so far, no luck.

Please help! I'd greatly appreciate it. Thanks very much in advance.


1 Answer 1


Answering my own question, in case it's useful to someone in the future. It turns out that the iframe issue was a red herring: the key point was the code 302 in the URL, which indicated a redirect because of likely invalid access. So the solution was to (a) ensure that the VF page was accessible to the user's profile (which it was already), (b) add the VF page to the Community's pages (via Setup - Communities - MyCommunity - Workspace - Administration - Pages - force.com site), and (c) change the URL in the Lightning component from




Once the page was added to the site, it wasn't even necessary to use the host name in the URL for the VF page.

Thanks everyone.

  • Thanks very much for answering your own question, saved me a lot of time knowing that the community needs to be part of the URL rather than just /apex/[pagename]
    – Salesf0rce
    Commented Mar 2 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .