6

Spring 14 is automatically enabling Clickjack protection on all non-setup pages. It's a critical update going live on Feb 9, 2014.

It seems that this update enables a same origin policy on the salesforce.com domain. I get that. What I don't know is whether an iframe on a force.com page that frames in a salesforce.com is supposed to be ok. As of now, it fails, but I am curious if that is a bug or by design.

Anyone know?

Improve this question
3
  • Are you doing this in pre-release org, or in Winter '13 with critical update applied? I ask, because clickjack is working correctly in Winter '13 in my dev org with the critical update applied.
    – sfdcfox
    Jan 21, 2014 at 21:51
  • Check the HTTP headers for X-Frame-Options and you'll see which domains are whitelisted.
    – Mike Chale
    Jan 21, 2014 at 22:16
  • I am doing this in a Winter 13 org with the critical update applied.
    – hemmeter
    Jan 22, 2014 at 5:32

1 Answer 1

Reset to default
2

@scott,

Of course, IANASFE (I am not a salesforce employee) but it would seem to me, on the face of it, that the clickjacking protection would not allow a force.com page to iframe in a salesforce.com page.

Here's my reasoning and please, someone, shoot me down. Click-jacking is fundamentally a privilege-execution security issue where someone/thing with privilege is tricked into innocently taking an action that executes code with their privileges. Problem is, the X-Frames-Options header is a pretty crude brush to paint with. Last I looked, (few weeks ago) there were only three options: DENY, SAMEORIGIN and ALLOW-FROM. In theory, Allow-from is our golden goose. The catch is ... if your browser does not support this relatively new addition (here's the browser compatability breakdown: https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options), the site is left without any active click-jack protection.

That means the safe, and secure default for IE < 8, all versions of Chrome, FF < 18, and all versions of Safari (including mobile) isn't ALLOW-FROM -- it's not supported -- but rather SAMEORIGIN.

Improve this answer
1
  • 1
    OTOH, force.com (Visualforce pages) do not use clickjack protection. It's only for standard pages (anything not starting with /apex/ inside the system). So, you can't commandLink yourself to a standard detail page, for example, but you can certainly create an entire UI of stuff in Visualforce that will work perfectly fine. Note that in the iframe scenario, any remote action methods must be globally scoped or they will fail.
    – sfdcfox
    Jan 22, 2014 at 17:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .