function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
swapna muthiyaluswapna muthiyalu 

why are visualforce pages served in different domain?

Best Answer chosen by swapna muthiyalu
Rajiv Penagonda 12Rajiv Penagonda 12
Simple answer - Security. Salesforce wants to keep tight control over what is customizable and what is not. Consider an example of a Visual force page running within your standard page-layout. If it runs in the same domain, the scripts in the VF page will be able to access the scripts on the standard page-layout and will be able to manipulate it.

As a matter of fact there used to be a side-bar hack where users could run scripts from side-bar and manipulate standard pages, which has since been disabled by ensuring all scripts and vf pages run in a different domain. Was this an interview question you had to face? :P

All Answers

Rajiv Penagonda 12Rajiv Penagonda 12
Simple answer - Security. Salesforce wants to keep tight control over what is customizable and what is not. Consider an example of a Visual force page running within your standard page-layout. If it runs in the same domain, the scripts in the VF page will be able to access the scripts on the standard page-layout and will be able to manipulate it.

As a matter of fact there used to be a side-bar hack where users could run scripts from side-bar and manipulate standard pages, which has since been disabled by ensuring all scripts and vf pages run in a different domain. Was this an interview question you had to face? :P
This was selected as the best answer
swapna muthiyaluswapna muthiyalu
Thank you so much Rajjiv. Yes its an interview question..
Anmol Kumar 24Anmol Kumar 24
I wish they had maintained the consistency and served the lightning components/LWC from the same domain as vf page.
because you cannot use vf inside lightning components with click-jack enabled.