We have a Canvas App configured as part of a Connected App, which is wired to a javascript frontend application. The frontend JS app has been hosted in AWS servers. The Connected App has been configured to use SAML to authenticate itself, and has Admin approved users are pre-authorized set on it.

When we create new users and add them to a permission set, we are encountering a transient one-time error Refused to display 'blah blah' in a frame because it set 'X-Frame-Options' to 'DENY'. If we click on the link and authenticate the first time, the problem vanishes in subsequent tries. Also, not all users are affected by this issue on their first login.

Research suggests that this error comes up because of Salesforce's clickjacking protection, as explained in this thread: Upcoming "clickjacking" protection

In Clickjack Protection settings of our sandbox, the option Enable clickjack protection for non-setup customer Visualforce pages with headers remains unchecked, while both Enable clickjack protection for setup pages and Enable clickjack protection for non-setup Salesforce pages have been enabled.

But I am unable to find explanation on how to avoid displaying a custom/external JS-based Canvas app in an iframe. Most comments I found are generic and say that we should avoid iframes, but don't explain how.

Need help in identifying the correct mechanism. Any/all pointers will be appreciated. Please do let me know if you need more details on app setup.

Please note that we have not hosted our App in AppExchange yet; its still under development. So when we test, we make changes to connected app by editing directly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.