I have a visualforce page with an iframe'd app. When you click a link in the iframe, it communicates with the parent window via postMessage and instructs the JS running on the parent window (visualforce page) to perform a window.open(url, '_blank').

The parent page hostname is like: https://foobar.na6.visual.force.com

The window.open hostname is like: https://snafu.foobar.na6.visual.force.com

I'm then getting a "Privacy Error" in chrome. It says:

[!] Your connection is not private

Attackers might be trying to steal your information from snafu.foobar.na6.visual.force.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID

This server could not prove that it is snafu.foobar.na6.visual.force.com; its security certificate is from *.na6.force.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

In chrome, this error happens every time we click the link, and we have to manually choose to proceed to the site.

Is there something we can do on our end to make this issue go away, or is this something SFDC needs to resolve?

  • Are you manually constructing the url for the window.open() call? Where does the prepended snafu. come from? (root question: do you actually need it there?)
    – Mark Pond
    Jul 13 '15 at 20:58
  • Yeah, i'm manually constructing it. "snafu" is needed, yeah. the url wont work correctly without it. Jul 14 '15 at 1:17
  • hmm, it doesn't look like foobar is needed though... when i remove the foobar part it works without a certificate problem. Jul 14 '15 at 2:04
  • Is the name that you are prepending part of a managed package namespace? How do you know what is prepended? If you make the window.open() URL relative instead of absolute, does the SFDC webserver redirect you to the "proper" host name without a cert warning?
    – Mark Pond
    Jul 14 '15 at 14:52
  • I believe that it is, yeah. I see that both "snafu" and "foobar" are labeled as Namespaces in Custom Settings and have their own Custom Settings that can be Manage'd. I don't think making the URL relative will work because that will only change the path, not the hostname. And I tried the link path under "foobar" and it didn't work. It only works under "snafu", Jul 16 '15 at 1:38

You can use a relative URL in the window.open() method if you specify the namespace of the managed package page in the path. Salesforce will automagically redirect you to the appropriate hostname when it resolves the namespace and loads the page.

If the managed package's namespace is snafu, the path to the VF page including this namespace would be /apex/snafu__TheManagedVFPage.

For reference, the default namespace that prefixes all pages that are not part of a package is c__. The path to your VF page can be written as /apex/c__YourPageName.

A related question with some additional details: How to redirect to default namespace vf page from managed package vf page?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.