[SalesForce] Salesforce summer 16 – page not loading in iframe

We have a salesforce app exchange listed application. In this we are opening certain application pages in iframe. I was working fine in lightning till spring 16. We were testing our app in the new summer 16 org as the release is around the corner and we found none of our pages are opening in iframe when lightning is turned ON. Its working in the classic mode though

We found that the error we got in the browser console was of a Content Security Policy (CSP) frame-ancestors 'self'

To test this I created 2 example pagesto check what happens if I hardcode the page url and try to open in an Iframe.

When I try to open Page 1 I got an error "Refused to display 'https://cs3.lightning.force.com/one/one.app#/apex/TestFrameInternal' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'"."

Now I am confused about this content security policy as it allows iframing but only when frame-ancestor is self. I need to understand if I have understood this content security policy correctly and will I be able to open visualforce pages in iframe in lightning ui in summer 16 or not.

First Page
Second Page

Best Answer

I just went through some docs and i want to share that:

1.Reason of error: See these links:

It says:

Description: Clickjacking attacks, and defenses like X-Frame-options, which are rising in popularity, are preventing iframes from being a valid way to display content. Since using an iframe is no longer possible, well give you more information on what your options are.

Resolution: Salesforce has also implemented its own defenses to "Clickjacking" attacks within the native UI. Due to this, the iFraming of Salesforce, or the iFraming of some external websites may no longer be possible. Modern browsers are forced to defend against this new kind of attack, where framing is used by malicious attackers to compromise a browser and potentially steal customer data.

Workaround: If you're encountering this problem, instead of using a web tab, a custom link can deliver the URL with the behavior set to:

Display in new window.
​Display in existing window without sidebar or header.

I haven't tested this issue myself. Probably I will give it a try and will come up with something better. Let me know if you get these points.

Related Topic