Scenario : I have built desktop based Force.com platform and now i have enabled the Salesforce 1 Mobile app on my environment. Now if i try to load the same Desktop based Quote Detail page on Iphone 5 emulator on Google Chrome, i get this error

: [Report Only] Refused to frame 'https://c.na10.visual.force.com/apex/QuoteDetail?id=a0RF000000IYFfjMAH&sfdcIFrameOrigin=https%3A%2F%2Fna10.salesforce.com&isdtp=p1&sfdcIFrameHost=web' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.

Please if some one could help me figure out the reason. Really appreciate it

From the comments, here is the quote detail page:

<apex:page standardController="Quote__c" title="Quote Detail" sidebar="false">
    <apex:form >
        <c:QuoteDetail theQuoteId="{!Quote__c.Id}" />
  • Yes sure, but it is going to be long. I have a QuoteDetail.page, QuoteDetail.component which is embedded in the QuoteDetail.page and QuoteDetail.controller. As well as QuoteDetail.css file. I will attach the QuoteDetail.page and QuoteDetail.component – user10684 Jul 28 '14 at 22:53
  • I am unable to add the code as it says out of space for characters – user10684 Jul 28 '14 at 22:55
  • Can you create a smallest possible VF page that still reproduces the error then :) We certainly don't want to read pages and pages of your logic... – eyescream Jul 28 '14 at 22:56
  • QuoteDetail.page <apex:page standardController="Quote__c" title="Quote Detail" sidebar="false"> <apex:form > <c:QuoteDetail theQuoteId="{!Quote__c.Id}" /> </apex:form> </apex:page> – user10684 Jul 28 '14 at 22:57
  • The QuoteDetail i.e <c:QuoteDetail> is a custom made component within the application. Any thoughts as to what might be causing the error – user10684 Jul 28 '14 at 23:17

You are seeing this error due to a Content Security Policy (CSP) breach - a CSP is an HTTP header that defines a bunch of policies for resources. You are falling foul of the frame-src restriction. You can read more about this at:


If the iphone5 emulator you are using is a chrome app, the default behaviour for those is to disallow external resources in iframes:

https://developer.chrome.com/apps/contentSecurityPolicy (search for frame-src).

If you don't have a real device I would use the desktop version of Salesforce1 (/one/one.app) with the browser resized appropriately.

| improve this answer | |
  • I am also running into the same "Content Security Policy directive: "default-src 'self'" error. I am attempting show google maps in a lightning component, I tried switching to "<webview" instead of Iframe but with no luck. Can anyone advise an easy way to whitelist an address for use in lightning components or other solution? – nickforce Oct 20 '14 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.