Hi Trailblazers,
We recently encountered an issue with Salesforce Mobile App v264 on iOS, where our LWC and Aura components embedding external pages through iframes stopped loading. Everything still works fine on Android, desktop, and older iOS versions
.
After investigating with Salesforce Support, we found that adding our domain under Session Settings → Trusted Domains for Inline Frames
resolves the issue.
Support explained that Salesforce introduced this change immediately to address a potential security risk involving session token exposure. We fully understand the importance of this security improvement.
However, this creates a challenge for ISVs. Our managed package was already working in customer orgs, but following this change, customers must manually update their settings to restore functionality. This is particularly difficult when supporting many customer orgs.
@Daniel Ballinger, we would really appreciate your guidance. Would it be possible to make this configuration packageable in managed packages, or provide another solution to avoid requiring manual changes in every customer org?
Thank you for your time and guidance!
cc:
#Salesforce Developer #ISV Partner #Appexchage Apps #Appexchange Packages #Security
