IFrameAction Not Loading

[ajcarlst]

Having a problem with Hubspot CRM Extensions. We have an IFrameAction that renders correctly in our contact record, and when clicked: opens the IFrame window...but the content does not appear. No errors are logged in Hubspot and network view shows calls being made to Hubspot analytics when we open the iframe but no calls are made for the actual page.

We have tried it two different ways (since the documentation is a little fuzzy on what are required fields):

            {
                "label": "Open Iframe",
                "type": "IFRAME",
                "width": 890,
                "height": 748,
                "uri": "https://www.google.com"
            }

and
{
"label": "Open Iframe",
"type": "IFRAME",
"width": 890,
"height": 748,
"uri": "https://www.google.com",
"associatedObjectProperties": []
}

I replaced www.google.com here for the actual value to eliminate our page being the issue but neither seems to work.

We have made sure to add the base URI's to the configuration in Hubspot as well.

Thanks much in advance for any help...or if there's better documentation somewhere that would be great as well. The examples are helpful but we've had to do a lot of trial and error to get specific on the definitions which has been time consuming since we have to deploy and can't test locally.

[polskyedd]

You cannot display a lot of websites inside an iFrame. Reason being that they send an "X-Frame-Options: SAMEORIGIN" response header. This option prevents the browser from displaying iFrames that are not hosted on the same domain as the parent page.

I faced the same error when displaying YouTube links. For example: https://www.youtube.com/watch?v=8WkuChVeL0s

I replaced watch?v= with embed/ so the valid link will be: https://www.youtube.com/embed/8WkuChVeL0s

It works well.

Try to apply the same rule on your case.

SAMEORIGIN

The page can only be displayed in a frame on the same origin as the page itself. The spec leaves it up to browser vendors to decide whether this option applies to the top level, the parent, or the whole chain, although it is argued that the option is not very useful unless all ancestors are also in the same origin.

[covalentcareers]

ALLOW-FROM is a deprecated directive that should not be used. Hubspot should not require it.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

[ajcarlst · Accepted solution]

"Solved" the problem after speaking to support. We were (and google was) passing an X-FRAME-OPTIONS : SAMEORIGIN header by default. We changed to X-FRAME-OPTIONS : ALLOW-FROM https://app.hubspot.com which now allows the page to load in the iframe (but does return an error from Hubspot saying that it is an unknown header so they are ignoring it).

[ajcarlst]

As an update...we are getting a "Confused Type" error I can see now in the logs...but can't find any explanation for that anywhere.