Refused to frame "vf.force.com/" because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'"

Question

--- Issue ---
I have a LWC inside my Managed Package which dynamically opens a Visualforce Page by its name inside iframe.

It worked ok in all orgs, However for the last 3-4 months I noticed that if org has:

• Lightning Web Security enabled
• Enable clickjack protection for customer Visualforce pages with headers disabled - checked ( see it in Setup -> Session Settings ).

than I get next error when opening a Visualforce Page inside iframe:

Refused to frame 'https://{domainName}--c.vf.force.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'".

What I see:

If I disable Lightning Web Security or "Enable clickjack protec..." it shows me Visualforce Page as expected.

I tried to add next URLs to CSP Trusted Sites, however it not helps:

• https://{domainName}.lightning.force.com
• https://{domainName}--c.vf.force.com
• https://{domainName}.my.salesforce.com

--- Question ---

Is there anything I need to add to my Visualforce Page to make it work without disabling these Settings ?

Maybe add some other configurations in the Session Settings ?

Any help will be appreciated.
Thank you.

Answer 1

Ok, the answer is right there on a Session Settings page in Setup.
See Trusted Domains for Inline Frames Section:

Visualforce Pages: Allow iframes of Visualforce pages with clickjack protection on external domains. To enable this feature, add external domains where you allow framing. Then, turn on one of the “Enable clickjack protection for customer Visualforce pages” preferences under Clickjack Protection.

So I added the next Trusted Domains there, with IFrame Type = "Visualforce Pages"

• https://{myDomain}.my.salesforce.com
• https://{myDomain}.lightning.force.com

And it now shows me Visualforce Page as expected.

Useful link: Visualforce page note displaying in iframe: Content Security Policy