We have Winter 16 preview sandbox and can see that Canvas App is rendered now as iframe in iframe (there is outer and inner iframes now). Before this release there was just one iframe. For now I'm not sure if issue below is caused by changes in canvas rendering behavior, but are these changes described anywhere since I can't locate it in Release Notes?

We also use parent.postMessage(message, targetOrigin) function on canvas page to fire some js functions in parent window that contains canvas and use "targetOrigin" parameter of canvas signed request. Now, in Winter 16 postMessage fails with "Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://cs11.salesforce.com') does not match the recipient window's origin ('https://c.cs11.visual.force.com').". It means that "targetOrigin" parameter of canvas signed request is pointing to "https://cs11.salesforce.com" in Winter 16, however in Summer 15 release where there are no iframe in iframe "targetOrigin" parameter of canvas signed request is pointing to correct URL - 'https://c.cs11.visual.force.com'. Is it some kind of SF issue passing incorrect targetOrigin in canvas signed request in Winter 16?


  • did you find a solution for this? we're experiencing similar problem.
    – parxier
    Commented Sep 20, 2015 at 23:33
  • for now we're communicating SF support to clarify the details
    – Victor
    Commented Sep 24, 2015 at 10:53
  • Seems like there are lots of Canvas issues with winter release success.salesforce.com/issues_view?id=a1p30000000TL1NAAW Commented Sep 28, 2015 at 5:57
  • having the same issue since na1 was updated this weekend with winter'16 none of our sforce interactions seems to be working.
    – Heyflynn
    Commented Sep 28, 2015 at 22:21
  • the problem seems to be with the winter'16 adding an additional iframe for canvas apps. the parent.postMessage only refers to the parent iframe now. per-winter'16 it references the parent window you want to post messages to. you'll notice window.parent.window.parent.postMessage works
    – Heyflynn
    Commented Sep 28, 2015 at 23:26

1 Answer 1


According to SF response introduction of inner and outer iframes as well as change in "targetOrigin" behavior are intended features and it works as designed. They are also going to update Release Notes with these changes but have not pointed the exact date.

  • I've just recieved the same response. Is it possible to get the value of the "targetOrigin" as it used to be? We are relying on it to build the URL to a VisualForce page from within our Canvas App.
    – Ronnie
    Commented Oct 8, 2015 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .