Below is an extract of the headers sent to PeopleSoft by the canvas frame.
POST /psc/xxxxxxx/EMPLOYEE/HRMS/s/WEBLIB_ACN.ISCRIPT1.FieldFormula.IScript_SFDCGW HTTP/1.1 Host: xxxx.peoplesoft.xxxxxxxx.com Connection: keep-alive Content-Length: 4090 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: https://c.na16.visual.force.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.81 Safari/537.36 Content-Type: application/x-www-form-urlencoded DNT: 1 Referer: https://c.na16.visual.force.com/servlet/servlet.Integration?lid=1111111111111&ic=1 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8,es;q=0.6 Cookie: INFAESAD0205-8100-PORTAL-PSJSESSIONID=xxxxxxxxxx!11111111; ExpirePage=https://xxxx.peoplesoft.xxxxxxxx.com/psc/xxxxxxx/; PS_LOGINLIST=https://xxxx.peoplesoft.xxxxxxxx.com/xxxxxxx; PS_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxx+xxxxxxxxxx==; SignOnDefault=; PS_DEVICEFEATURES=width:1366 height:768 pixelratio:1 touch:0 geolocation:1 websockets:1 webworkers:1 datepicker:1 dtpicker:1 timepicker:1 dnd:1 sessionstorage:1 localstorage:1 history:1 canvas:1 svg:1 postmessage:1 hc:0; PS_TOKENEXPIRE=26_May_2015_12:37:26_GMT
Access-Control-Allow-Credentials:true Access-Control-Allow-Origin:https://c.na16.visual.force.com Cache-Control:no-cache Cache-Control:no-store Content-Encoding:gzip Content-Length:727 Content-Type:text/html; CHARSET=UTF-8 Date:Tue, 26 May 2015 12:37:53 GMT Expires:Thu, 01 Dec 1994 16:00:00 GMT IgnorePortalRegisteredURL:1 PortalRegisteredURL:https://xxxx.peoplesoft.xxxxxxxx.com/psc/xxx/EMPLOYEE/HRMS/s/WEBLIB_ACN.ISCRIPT1.FieldFormula.IScript_SFDCGW Set-Cookie:PS_TOKENEXPIRE=26_May_2015_12:37:53_GMT; path=/; secure UsesPortalRelativeURL:true
Normally I can do this within my connected app:
top.location.href = '/xxxxx';
But in this case I am getting this error:
Uncaught DOMException: Blocked a frame with origin "https://xxxx.peoplesoft.xxxxxxxx.com" from accessing a cross-origin frame.
This is most likely a PeopleSoft-related question but I'm trying to understand how is Salesforce able to allow cross domain access for connected apps (apart from the Canvas js lib).