Is this possible to do anymore? I'm trying to iframe Salesforce, in it's entirety for SSO functionality without having the user leave my web application. My application is a connected app and we would be working with the admins of any clients directly to setup for this, so there is not a concern of access rights or configuration. If salesforce allows it we would be able to also configure specific domains.

I've tried configuring CSP Trusted Sites & Remote Site Settings.

I've looked into 'clickjack' protection but that seems to be inside of sites and communities which is a subset of the experience. I'm looking for the full experience as though it were opened in a new tab, but in an iframe.

Currently the error I'm getting is:

Refused to frame 'https://cs195.lightning.force.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".

note: when I open in a new tab instead of an iframe the SSO functionality works perfectly.

1 Answer 1


No, you can't iframe/embed Salesforce in an app. You'd want to use an OAuth flow with a state parameter to navigate the user back to the previous state in your web app. See the Web Server Flow documentation for details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .