I am trying to embed an external webpage in vfp using Iframe or canvas. However, in both the cases I am not able to display the content. It appears blank.

As per my search, that it might not be possible due to the X-Frames.

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a , or . Sites can use this to avoid click jacking attacks, by ensuring that their content is not embedded into other sites.

Practically, almost all the browsers support the feature.

Browsers Supporting X-Frame-Options • IE8+ • Opera 10.50+ • Safari 4+ • Chrome (Allow-From not yet supported) • Firefox 3.6.9 (or earlier with No Script)

I have option of using the link in webpage layout but that will not serve the purpose.

  • Thats a browser security implementation for websites you can not do this. Actually you are trying to hack this. – Ashwani May 14 '14 at 19:44
  • @regal Is there any other way. Actually I am supposed to open a tab of external website in salesforce on click of a link. but I am not able to do so. It appears blank for some websites – user2703132 May 15 '14 at 6:31
  • Xframe options don't allow accessing site page as a child in any case. – Ashwani May 15 '14 at 6:36

Any mechanism that displays a page wrapped inside a Salesforce page will be using a iframe, and all modern browsers will respect the X-Frame-Options header and refuse to display the page. There is no workaround for this, as you would have to force the browser not to respect the header and allow the content to be included. Even going the JavaScript route, using something like jquery.load, is likely to fail due to the browser same origin policy.

If you want to display the content of a single page from an external system, you can access it server side and then make the content available through a Visualforce page. The following code snippet accesses the google home page:

 HttpRequest req = new HttpRequest();

 Http http = new Http();
 HTTPResponse res = http.send(req);

note that you need to add the target site (http://www.google.co.uk) as a remote site for this to work correctly. However, this wouldn't allow you to navigate off of the page or carry out an HTTP post etc, as at that point the browser will receive the X-Frame-Options header and block access again. You could in theory rewrite all links on the page so that they made the request back to your controller and you pulled in the next page from the remote site etc, but that would be a huge amount of effort for very little return.

  • Thanks Bob for the input.but I need to access another website and probably it won't work this way. Is there anything other than Iframes that can work? – user2703132 May 15 '14 at 10:06
  • Nothing that I'm aware of - you'll have to open the page in a new window I think. – Bob Buzzard May 15 '14 at 10:10
  • Yes Bob, I had created a link on standard webpage for that. But just wanted to check if we have some way out to embedd it in salesforce only. – user2703132 May 15 '14 at 10:13
  • Only by content scraping as above. If you access it directly from the browser, it has to be a top level page. – Bob Buzzard May 15 '14 at 10:23
  • Can I use Salesforce Console Integration Toolkit in console app – user2703132 May 20 '14 at 4:51

As I understand it, you can use Visualforce Sites in iFrames if you 'Enable clickjack protection for non-setup Salesforce pages' in 'Session Settings'. The problem is you then open yourself to clickjacking. But you can use X-FRAME setting such as ALLOW-FROM uri to stop it working as an iFrame in anything other than your own website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.