We use cookies to make HubSpot's community a better place. Cookies help to provide a more personalized experience and relevant advertising for you, and web analytics for us. To learn more, and to see a full list of cookies we use, check out our Cookie Policy (baked goods not included).

Allow cookies

SalseForce Clickjack Protection Blocks HubSpot Visualforce Integration

: Not Currently Planned
sboman
Submitted by on ‎Sep 13, 2017 10:50 AM

As a technology company, we are very security conscious. If we enable clickjack protection for visualforce, we cannot use the HubSpot Intelligence tools in SalesForce. HubSpot should modify the integration settings so that it does not trigger clickjack. You can find the release notes on Clickjack protection here

See more ideas labeled with:
HubSpot updates
changed to: Not Currently Planned
Sep 18, 2017

Hi all -- Salesforce's clickjack protection is an optional setting that prevents iframes from rendering if the iframe is served from a domain that's different than the salesforce organization's visualforce domain. HubSpot's visualforce pages, including the HubSpot Intelligence view, are served and maintained on HubSpot owned and controlled domains. This allows us to improve and maintain the pages without the need for package releases and updates.

 

We understand the importance of security to your business, so if you would like to use salesforce's clickjack protection, we recommend mapping the HubSpot properties to salesforce lead and contact fields. All of the information displayed within the visualforce pages can be synced directly to leads and contacts, so removing the visualforce pages won't limit any infromation from being viewed in salesforce.  

For instructions on mapping HubSpot properties to Salesforce fields, please refer to this help article or watch this tutorial:

- https://knowledge.hubspot.com/articles/kcs_article/salesforce/how-do-i-map-a-hubspot-field-to-salesforce
- https://academy.hubspot.com/hubfs/In-Product%20Tool%20Walk-Throughs/Field%20Mapping.mp4

1 Reply
_Kevin
HubSpot Product Team
HubSpot Product Team
‎Sep 18, 2017 1:54 PM - edited ‎Sep 20, 2017 6:32 PM
updated to: Not Currently Planned

Hi all -- Salesforce's clickjack protection is an optional setting that prevents iframes from rendering if the iframe is served from a domain that's different than the salesforce organization's visualforce domain. HubSpot's visualforce pages, including the HubSpot Intelligence view, are served and maintained on HubSpot owned and controlled domains. This allows us to improve and maintain the pages without the need for package releases and updates.

 

We understand the importance of security to your business, so if you would like to use salesforce's clickjack protection, we recommend mapping the HubSpot properties to salesforce lead and contact fields. All of the information displayed within the visualforce pages can be synced directly to leads and contacts, so removing the visualforce pages won't limit any infromation from being viewed in salesforce.  

For instructions on mapping HubSpot properties to Salesforce fields, please refer to this help article or watch this tutorial:

- https://knowledge.hubspot.com/articles/kcs_article/salesforce/how-do-i-map-a-hubspot-field-to-salesf...
- https://academy.hubspot.com/hubfs/In-Product%20Tool%20Walk-Throughs/Field%20Mapping.mp4