I am trying to frame external web application URL in salesforce using webtab, I am unable to connect to the external web application.

I have tried the following steps to mitigate issue but i am still getting the same error message, any help would be appreciated.

  • I have Setup the External Web URL in CORS
  • I have Setup the External Web URL in RemoteSite Settings

Error message which i encountering is:

Refused to frame 'https://XYZ.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".

Any help would be appreciated.


It sounds like the external site has a "self" content security policy and therefore can never be embedded in an iframe on a page originating from a different site (such as Salesforce in your case). This is getting more common since it is a way to mitigate against XSS and clickjacking.

You need to look at the documentation for the external system you wish to embed to see if it provides a means to change this policy. If it doesn't, you will never be able to embed it and will have, instead, to simply provide a button to open the external system in a separate browser tab/window. If it allows you to add your Salesforce org URL(s) as trusted sites on that external system you can then probably do what you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.