We have an AppExchange App which integrates with external application (website) via Salesforce REST API. App has already passed Security Review as it is composite app Salesforce and External application both were tested by Security Review team.

As one of the enhancements, we will need to embed the external application (website) within a Salesforce tab/page/page layout. User will see a login screen and they need to login to External Application. Ideally, it should be done through SSO which is in our future road map.

Can some one please confirm if it is okay to embed a secure external website in IFRAME of AppExchange app, which was already scanned as part of the security review?

  • Does it need to be an iframe? A more standard solution would be to create a Custom Tab, which could also facilitate SSO when you get around to it.
    – sfdcfox
    Jan 20, 2021 at 12:08

2 Answers 2


It’s totally ok to iframe an external URL and you won’t be stopped from doing it!

Severity review will ask you for the BURP/ZAP/Chimera scans of your endpoints that you will be using within Salesforce!

While SSO is an option, the other elegant solution would be to use Salesforce Canvas that can use signed request to establish authentication or it can also use OAuth 2.0

Using Canvas is not only secure but will allow you to interact with Salesforce data elegantly without having to pass around data in URL


Sorry for adding as answer and not as comments, as I can't post large comment

Thank you Mohith for the answer. Yes, the external site which we are planning to embedding has already gone throguh security review and as part of submission we will generate ZAP report and fix all the high/medium issues (if any). SSO/Canvas is already in the future road map.

But for the basic version, we plan to do:

  1. Open a Web tab, for user to sign in with External App user details.

  2. View the site in the Web tab and embed Widget within Account page layout

  3. A VFP with standard controller Account will be created, which will pass the required info to the child page of External website (By windows.postMessage()) to load the widget based on passed Account Id. See below sample code for Widget:

             <apex:page sidebar="false" showHeader="false" standardController="Account"> <!-- Code in Visualforce Page -->
             <apex:includeScript value="{!$Resource.jquery}"/>
             <h1>This Text is written in Parent page. Below content starts from Child Page.  </h1><br/> 
             <apex:iframe src="https://example.com/MyAccountWidget" scrolling="true" id="theIframe" height="600px" width="100%"/>
                    $('#iframeid').ready(function () {
                    function sendMessageToChildWindow()
                         let win = window.frames.theIframe;
                         win.postMessage("Hello child page, I hope you got this message from Account Name {!HTMLEncode(Account.Name)} with Account Id {!HTMLEncode(Account.Id)}" , "https://example.com");           
             **External App Widget Code (non Salesforce page):**
                  <h2>Below is the message from Parent Window</h2>
                 <div id="results"></div>
                 var results = document.getElementById('results');
                 function bindEvent(element, eventName, eventHandler) {
                             if (element.addEventListener) {
                                 element.addEventListener(eventName, eventHandler, false);
                             } else if (element.attachEvent) {
                                 element.attachEvent('on' + eventName, eventHandler);
                 // Listen to message from child window
                         bindEvent(window, 'message', function (e) {
                             results.innerHTML = e.data; // Instead of result actual widget will be displayed here.

Please let us know thoughts on using windows.postMessage() to load content according to the paramters from parent page. We are also planning to discuss above with Salesforce Security Office Hours.


  • The window.postMessage() is secure if you post it to a know domain! So looks like you are doing that! Should be fine but work with security review team and use office hours to get confirmation on it! Jan 21, 2021 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .