1

I have a visualforce page with an iframe'd app. When you click a link in the iframe, it communicates with the parent window via postMessage and instructs the JS running on the parent window (visualforce page) to perform a window.open(url, '_blank').

The parent page hostname is like: https://foobar.na6.visual.force.com

The window.open hostname is like: https://snafu.foobar.na6.visual.force.com

I'm then getting a "Privacy Error" in chrome. It says:

[!] Your connection is not private

Attackers might be trying to steal your information from snafu.foobar.na6.visual.force.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID

This server could not prove that it is snafu.foobar.na6.visual.force.com; its security certificate is from *.na6.force.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

In chrome, this error happens every time we click the link, and we have to manually choose to proceed to the site.

Is there something we can do on our end to make this issue go away, or is this something SFDC needs to resolve?

Improve this question
5
  • Are you manually constructing the url for the window.open() call? Where does the prepended snafu. come from? (root question: do you actually need it there?)
    – Mark Pond
    Jul 13, 2015 at 20:58
  • Yeah, i'm manually constructing it. "snafu" is needed, yeah. the url wont work correctly without it.
    – Jamey Lazarus
    Jul 14, 2015 at 1:17
  • hmm, it doesn't look like foobar is needed though... when i remove the foobar part it works without a certificate problem.
    – Jamey Lazarus
    Jul 14, 2015 at 2:04
  • Is the name that you are prepending part of a managed package namespace? How do you know what is prepended? If you make the window.open() URL relative instead of absolute, does the SFDC webserver redirect you to the "proper" host name without a cert warning?
    – Mark Pond
    Jul 14, 2015 at 14:52
  • I believe that it is, yeah. I see that both "snafu" and "foobar" are labeled as Namespaces in Custom Settings and have their own Custom Settings that can be Manage'd. I don't think making the URL relative will work because that will only change the path, not the hostname. And I tried the link path under "foobar" and it didn't work. It only works under "snafu",
    – Jamey Lazarus
    Jul 16, 2015 at 1:38

1 Answer 1

Reset to default
1

You can use a relative URL in the window.open() method if you specify the namespace of the managed package page in the path. Salesforce will automagically redirect you to the appropriate hostname when it resolves the namespace and loads the page.

If the managed package's namespace is snafu, the path to the VF page including this namespace would be /apex/snafu__TheManagedVFPage.

For reference, the default namespace that prefixes all pages that are not part of a package is c__. The path to your VF page can be written as /apex/c__YourPageName.

A related question with some additional details: How to redirect to default namespace vf page from managed package vf page?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .