This issue happen randomly in GS0 orgs, where the iframe try to load a VF which is redirected form .lightning.force.com/apex/vf (302 Moved Temporarily) to .my.salesforce.com/apex/vf (302 Found) to .visualforce.com/apex/vf (302 Moved Temporarily) to .visualforce.com/visualforce/session?url=

After that the iframe will try to request for the standard salesforce login page "https://login.salesforce.com" ending in refuse display 'X-Frame-Options' to 'deny' console error

Same thing happens when requesting the VF through workbench, this VF was installed from a managed package to which as a User I have access.

1 Answer 1


Not recommended, but you can try to Disable Clickjack Protection (see article)


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .