Loading
システム管理者に対するフィッシング耐性MFA・全従業員ユーザーMFAの適用のお知らせ 続きを読む

LWC iframe Fails to Load in Field Service Mobile Due to CSP frame-ancestors Blockage

公開日: Jul 28, 2026
説明
Problem

When a Field Service Lightning (FSL) Mobile app user taps an action button that invokes an LWC iframe component embedding a cross-org Salesforce Site or Visualforce page, the embedded content fails to load. The FSL Mobile app displays either a net::ERR_BLOCKED_BY_RESPONSE error or a blank screen instead of the expected content.
 
Cause

The FSL Mobile app's rendering engine enforces Content Security Policy (CSP) directives strictly. When the embedded Salesforce Site or Visualforce page has Clickjack Protection set to "Strict" (the default), its CSP frame-ancestors 'self' directive blocks the iframe from loading across different domains.

Unlike a web browser — which may silently fail or log only a console warning — the FSL Mobile app surfaces this blockage visibly as a net::ERR_BLOCKED_BY_RESPONSE error or blank content.

Note: The Trusted URLs list on the FSL org governs what the FSL org is allowed to reach outbound. It does not override the embedded site's decision to refuse being framed. Configuration changes must be made on the embedded site's org.
 
Troubleshooting

Symptom: net::ERR_BLOCKED_BY_RESPONSE in the FSL Mobile app when tapping the action button.
Cause: The embedded site's CSP frame-ancestors directive is blocking the iframe in the FSL Mobile app's rendering engine.
Resolution: Follow the Resolution steps below. If the error persists after configuration, clear the FSL Mobile app cache and log in again.
Symptom: Iframe displays a blank screen in the FSL Mobile app but renders correctly in a web browser.
Cause: The FSL Mobile app's rendering engine surfaces CSP blockage as a blank screen. The root cause is the same — frame-ancestors is blocking the iframe.
Resolution: Verify the Clickjack Protection setting and frame-ancestors allowlist on the embedded site. Confirm the FSL Mobile app domain is spelled exactly as it appears in your org, including sandbox identifiers.

Symptom: Iframe still does not load in the FSL Mobile app after configuring Clickjack Protection.
Cause: The FSL org may have CSP Trusted Sites restrictions preventing outbound requests to the embedded site.
Resolution: Add the embedded site's domain to the FSL org's Trusted Sites list via Setup → Security → CSP Trusted Sites and save.
解決策
Resolution

The frame-ancestors CSP directive on the embedded site is blocking the FSL Mobile app iframe. Follow the steps below to resolve.

On the embedded site's org (the org hosting the Site or Visualforce page):

  1. In Setup, navigate to Sites.
  2. Click the name of the Site hosting the page you want to embed.
  3. Under Clickjack Protection Level, select Allow framing of site pages on external domains (good protection).
  4. In the frame-ancestors allowlist, add the following FSL Mobile app domains (replace <fsl-org-domain> with your actual FSL org domain):
    • https://<fsl-org-domain>.sandbox.lightning.force.com
    • https://<fsl-org-domain>.sandbox.my.salesforce.com
    • https://<fsl-org-domain>--c.sandbox.vf.force.com
  5. Click Save.


On the FSL org:

  1. In Setup, navigate to Security → CSP Trusted Sites.
  2. Add the embedded site's domain (e.g., https://<embedded-site-domain>.sandbox.force.com) to the Trusted Sites list.
  3. Click Save.


Verify the fix:

  1. Log in to the Field Service Lightning Mobile app.
  2. Open a Service Appointment.
  3. Tap the action button that invokes the LWC iframe component.
  4. Confirm the embedded content renders without a net::ERR_BLOCKED_BY_RESPONSE error or blank screen.


Note: This issue is specific to cross-org embedding. If the LWC iframe embeds a Site or Visualforce page from the same org, CSP frame-ancestors blockage does not typically occur and Clickjack Protection adjustments are not required. Ensure domain names in the allowlist exactly match the FSL org's domain, including sandbox identifiers such as --dev2 or --c — domain mismatches will cause the iframe to remain blocked.

その他のリソース
Additional Resources
ナレッジ記事番号

005390158

 
読み込み中
Salesforce Help | Article