I am trying to iFrame a site external to Salesforce into a Communities page and I'm receiving the expected error of "Refused to display '[URL link]' in a frame because it set 'X-Frame-Options' to 'sameorigin'."
This Salesforce document: https://help.salesforce.com/articleView?id=000003366&type=1 and a few other forum posts that I found say that iFraming into Salesforce is everything from not recommended to almost impossible. A few posts used workarounds that may make a security department queasy.
Basically, I have a simple Lightning Component with an iframe tag:
<aura:component implements="flexipage:availableForAllPageTypes,forceCommunity:availableForAllPageTypes" access="global" >
<iframe width="800" height="600" style="border: 1px solid" src="[URL]" />
I put this component into a Community page and the iframe just shows up blank with the X-frame options error. Now, would this work even work with the X-frame options altered? Or are there larger issues with iFraming in Salesforce Communities that I have yet to discover? I guess I'm trying to determine if this is no longer possible – i.e., has Salesforce locked iFraming down?
Best Answer
I confirmed that this is indeed possible through a POC - the component I described above displayed the page as expected with a "contentOnly" flag set. The owners of the framed website just needed to adjust their webconfigs to allow the iFraming.