7

There are a number of reasons why this is frustrating. The biggest for me is that embedded visualforce pages can't use JavaScript to access the parent frame. There doesn't seem to be any benefit serving visualforce from a separate domain, is it a security decision? I am sure there are still plenty of ways to use the platform for something evil. I am not looking for a solution to a specific problem just a better understanding of why visualforce was implemented in this way.

1
  • If it is of interest, I was able access an element from the parent page okay using javascript - eg alert(jQuery('#acc2_ileinner', window.parent.document).html()); displays the company name from an embedded vf page on an Account Detail page. Nov 1 '12 at 10:56
17

While I've never seen this information in an official Salesforce document, Doug Chasman answered this on the developerforce boards back in 2009:

The move to separate domains has one very specific purpose: leverage the browser security model (same domain policy) to protect our customers and the salesforce.com service from cross site scripting and cross site request forgery attacks.

Moving to the serving pages from separate domains is a critical component of our ongoing commitment to insure the highest level of security and availability for everyone.

In the world where everything is served from the same domain any custom page that you visit had full access to any other page in your org and also any page served from salesforce.com itself. This included potentially malicious code that was installed as part of a force.com package.

The original thread can be found at:

http://boards.developerforce.com/t5/Visualforce-Development/Please-explain-cs2-salesforce-com-vs-c-cs2-salesforce-com/td-p/110601

1
  • 1
    I verbally heard the same comments for a senior product management director as well. Nov 2 '12 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.