Activity › Forums › Salesforce® Discussions › Why are Visualforce pages served from a different domain in Salesforce?

Tagged: , , , , ,

  • Hariom Chaudhary

    Member
    August 20, 2019 at 5:57 am

    If we see carefully, all our Visualforce pages are served like “c.YOURSERVER.visual.force.com/apex/YOURPAGENAME” ,
    And because of this most of time, we run into Same-Origin Policy error in Javascript if we try to access parent page from Iframe. Following reason is explained by one of the evangelists of Salesforce:

    “The move to separate domains has one very specific purpose: leverage the browser security model (same domain policy) to protect our customers and the salesforce.com service from cross-site scripting and cross-site request forgery attacks.

    Moving to the serving pages from separate domains is a critical component of our ongoing commitment to ensure the highest level of security and availability for everyone.

    In the world where everything is served from the same domain any custom page that you visit had full access to any other page in your org and also any page served from salesforce.com itself. This included potentially malicious code that was installed as part of a force.com package.”

Log In to reply.

Popular Salesforce Blogs

Popular Salesforce Videos

Report

Harassment or bullying behavior
Harassment or bullying behavior
Contains mature or sensitive content
Contains misleading or false information
Mobile App Reported Contents
Contains abusive or derogatory content
Contains spam, fake content or potential malware

Block Member?

Please confirm you want to block this member.

You will no longer be able to:

  • See blocked member's posts
  • Mention this member in posts
  • Invite this member to groups
  • Message this member
  • Add this member as a connection

Please note: This action will also remove this member from your connections and send a report to the site admin. Please allow a few minutes for this process to complete.

Report

You have already reported this .