I am running into an issue in a lightning community where we need to use an iframe to load a visualforce page (yes, it needs to be an iframe and not a lightning:container).
The issue I'm running into is that the CSP blocks the iframe from loading for what appears to be the reason of www vs non-www urls. This appears to be browser specific
The displayed url is formatted like this:
In chrome, it only loads if the url is www.portal.company.com.
In firefox, it only loads if the url is portal.company.com
If I change the browser url to www.portal.company.com, the iframe works okay in firefox.
If I set the browser url to portal.company.com, it shows a 'content blocked' error.
So it looks like in FF, the SLD is an issue. In Chrome, it's an issue in the other direction.
What type of solution should I be looking to pursue here? I don't think I can get away from using the iframe, as it's part of a very specific solution to use Google Tag Manager w/ DataLayer (which is blocked by locker in normal circumstances).