I am running into an issue in a lightning community where we need to use an iframe to load a visualforce page (yes, it needs to be an iframe and not a lightning:container).

The issue I'm running into is that the CSP blocks the iframe from loading for what appears to be the reason of www vs non-www urls. This appears to be browser specific

The displayed url is formatted like this:


In chrome, it only loads if the url is www.portal.company.com.

In firefox, it only loads if the url is portal.company.com

If I change the browser url to www.portal.company.com, the iframe works okay in firefox.

If I set the browser url to portal.company.com, it shows a 'content blocked' error.

So it looks like in FF, the SLD is an issue. In Chrome, it's an issue in the other direction.

What type of solution should I be looking to pursue here? I don't think I can get away from using the iframe, as it's part of a very specific solution to use Google Tag Manager w/ DataLayer (which is blocked by locker in normal circumstances).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.