Overview
M-Files plug-in for Salesforce shows error "Content blocked".
Usually, the proper cross origin setting at M-Files admin resolves the issue - see Section 2 here: Installing and Configuring M-Files Add-in for Salesforce CRM.pdf.
If this does not help, it may be that some security settings on the Salesforce side require their Trusted Sites setting to include your vault address.
Symptoms
When users navigate to M-Files web page inside salesforce portal, the M-Files web page does not load and simply shows "Content blocked" message in the UI.
The browser console shows the following error highlighted in red.
Refused to frame "https://<M-files web URL>" because it violates the following Content Security Policy directive: ....
Solution
To fix the Salesforce error you must add the framing domain to the Trusted Sites settings in Salesforce Setup to allow it to be displayed in a frame.
Add the Domain to Trusted Sites
- Go to Setup in Salesforce.
- Search for and select Trusted Sites.
- Click Add Domain.
- Enter the domain you want to frame (e.g., https://abc.cloudvault.m-files.com/).
- In the Content Security Policy (CSP) Settings section, select the appropriate context for the directive (e.g., Visualforce Pages or All for broader application).
- Click Save.
