--- Issue ---
I have a LWC inside my Managed Package which dynamically opens a Visualforce Page by its name inside iframe.
It worked ok in all orgs, However for the last 3-4 months I noticed that if org has:
- Lightning Web Security enabled
- Enable clickjack protection for customer Visualforce pages with headers disabled - checked ( see it in Setup -> Session Settings ).
than I get next error when opening a Visualforce Page inside iframe:
Refused to frame 'https://{domainName}--c.vf.force.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".
What I see:
If I disable Lightning Web Security or "Enable clickjack protec..." it shows me Visualforce Page as expected.
I tried to add next URLs to CSP Trusted Sites, however it not helps:
- https://{domainName}.lightning.force.com
- https://{domainName}--c.vf.force.com
- https://{domainName}.my.salesforce.com
--- Question ---
Is there anything I need to add to my Visualforce Page to make it work without disabling these Settings ?
Maybe add some other configurations in the Session Settings ?
Any help will be appreciated.
Thank you.
