Admin approved users are pre-authorized set on it.
When we create new users and add them to a permission set, we are encountering a transient one-time error
Refused to display 'blah blah' in a frame because it set 'X-Frame-Options' to 'DENY'. If we click on the link and authenticate the first time, the problem vanishes in subsequent tries. Also, not all users are affected by this issue on their first login.
Research suggests that this error comes up because of Salesforce's clickjacking protection, as explained in this thread: Upcoming "clickjacking" protection
In Clickjack Protection settings of our sandbox, the option
Enable clickjack protection for non-setup customer Visualforce pages with headers remains unchecked, while both
Enable clickjack protection for setup pages and
Enable clickjack protection for non-setup Salesforce pages have been enabled.
But I am unable to find explanation on how to avoid displaying a custom/external JS-based Canvas app in an iframe. Most comments I found are generic and say that we should avoid iframes, but don't explain how.
Need help in identifying the correct mechanism. Any/all pointers will be appreciated. Please do let me know if you need more details on app setup.
Please note that we have not hosted our App in AppExchange yet; its still under development. So when we test, we make changes to connected app by editing directly.