I have a lightning component with iFrame. I a getting the 'sameorigin' issue. am I missing anything?

Lightning Component:

<aura:component implements="flexipage:availableForAllPageTypes,
                            flexipage:availableForRecordHome" access="global">
    <aura:attribute name="iframeUrl" type="String" />
    <aura:attribute name="width" type="String" />
    <aura:attribute name="height" type="String" />
    <aura:attribute name="scrolling" type="String" />
    <aura:attribute name="frameBorder" type="String" />
    <aura:attribute name="style" type="String" />
    <aura:attribute name="sandbox" type="String" />

    <iframe src="{!v.iframeUrl}"



<design:component label="iFrame Component">
    <design:attribute name="iframeUrl" label="Source URL (HTTPS only)" default="https://www.google.com/"/>
    <design:attribute name="width" label="Width" default="100%"/>
    <design:attribute name="height" label="Height" default="500px"/>
    <design:attribute name="style" label="Style" default="border: none; overflow: scroll;"/>
    <design:attribute name="scrolling" label="Scrolling" default="auto"/>
    <design:attribute name="frameBorder" label="Frame Border" default="0"/>
    <design:attribute name="sandbox" label="Frame Border" default="allow-same-origin allow-scripts allow-forms"/>


Refused to display 'https://www.google.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

  • 2
    Google doesn't want to be placed in an iframe, so you can't place it in an iframe. Try using a resource that allows itself to be framed.
    – sfdcfox
    Jan 16, 2019 at 17:36
  • @sfdcfox, actually I am trying to embed a tableau dashboard on Lightning Home page. So, Tableu also has the same issue, so I need to think about different approach
    – Ajay
    Jan 16, 2019 at 17:48
  • I am currently working on tableau is the dashboard is public facing or private. public one works for me please try with visualforce page first. I used VF page to show. Jan 16, 2019 at 18:05
  • Please also try implement forceCommunity:availableForAllPageTypes interface. Jan 16, 2019 at 18:10

2 Answers 2


There are instructions on Tableau's site for how to properly embed views. Aside from this, there's not much we're going to be able to do to assist you. If you need further assistance with this, consider contacting their support. Security errors from other domains require support from the other domain. Lightning itself has some CSP restrictions, but these would not affect any secure site that has the correct headers.


Finally I went back to VF page option. and it worked fine. I thought of using Lightning component instead of VF page, however no luck

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .