function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Clemens MittlClemens Mittl 

Difference between Web Tab and Canvas Implementations in Salesforce concerning X-Frame Options and Content Security Policy directives

Hello Salesforce Developers,
is anyone of you actively using Salesforce Canvas in Lightning in 2018?

We are trying to embed some internal hosted Web Applications into our Salesforce Instance, using canvas.

At first the reuqest got rejected and in order to find out if that was due to the authentification header from Salesforce Canvas i implemented the external Web App also as a Web Tab in our Salesforce Instance.

It turned out that the issue was due to the 'sameorigin' settings on the side of our Web App preventing it to be loaded in an iframe.

Strangely after experimenting with the configs:

The Web Tab in Salesforce now successfully shows to our Web Application, while in Salesforce Canvas we still see the following error:

"in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.salesforce.com"."

Therefore i wonder if anyone know how "Web Tab" and "Canvas" Integrations in Salesforce differ in their implementations so that we can get some more ideas what we could try in order to make this Canvas Integration work - for now i don´t want to fall back to custom links opening in a new tab as the embeded nature will help us in creating a "seamless" flow for the users.


It gets even more complicated:

While the Web Tab is loading successfully in Salesforce Classic, the same is not true for Lightning Experience (Same error as in the canvas integration)

Thanks a lot for any hints you can share.

Best regards,
Clemens