Why an Iframe loading a VF embedded in a lightning component gets redirected to “visualforce.com/visualforce/session?url”

Question

This issue happen randomly in GS0 orgs, where the iframe try to load a VF which is redirected form .lightning.force.com/apex/vf (302 Moved Temporarily) to .my.salesforce.com/apex/vf (302 Found) to .visualforce.com/apex/vf (302 Moved Temporarily) to .visualforce.com/visualforce/session?url=

After that the iframe will try to request for the standard salesforce login page "https://login.salesforce.com" ending in refuse display 'X-Frame-Options' to 'deny' console error

Same thing happens when requesting the VF through workbench, this VF was installed from a managed package to which as a User I have access.

Answer 1

Not recommended, but you can try to Disable Clickjack Protection (see article)

https://help.salesforce.com/articleView?id=pardot_sf_connector_disable_clickjack.htm&type=5