Why you should never use external iFrames - and the one exception to this rule

[Dawn Jurek]

You're fleshing out an HTML page for your ServiceNow instance, and you'd like to embed some useful content for your users. Can't you just edit the HTML to include an external iFrame in the code? No, you shouldn't, but there's one exception to this rule. So what should you do instead? In this seventh installment of our best practices series, we look at ways to correctly embed content for your ServiceNow instance, and the one time that you can use external iFrames.

The <iframe> tag creates an inline frame in an HTML document for the purpose of embedding another document within that HTML document. While this functionality was never documented or supported by ServiceNow, it did work in older versions of the platform. But now, due to security constraints, that functionality is no longer available. So if you try to embed ServiceNow content in an external iFrame, it will not work, or it will break when you upgrade.

Note that the operative word here is external. You can use iFrames to your heart's content, as long as they are internal.

How to correctly use iFrames in your ServiceNow instance

You can use internal iFrames if you configure them through the Content Management System (CMS). To add a new iFrame in CMS, navigate to Content Management > Specialty Content > iFrames and click New. The Product Documentation provides more information about how to configure iFrames.

Another way to deliver ServiceNow content from a web page

Service Portal is an alternative to CMS and a simple way to create portals for end users of ServiceNow. It interacts with the underlying ServiceNow platform, so you can access specific platform components within Service Portal and build content quickly.

Both expert developers and total beginners can use Service Portal. Less technical users can make basic configuration changes to the UI using Branding Editor and other components of Service Portal, and more advanced users can edit and extend portals, pages, and widgets. Expert users can use the Widget Editor tool to write AngularJS, SCSS, and JavaScript to power a portal, and even create rich web applications on the ServiceNow platform.

Check out Get Started with Service Portal to explore this option.

The one exception to the rule - the login portlet

Now back to our original quandary. The only time you should ever use an external iFrame is when you want to create an unbranded user and password prompt on an HTML page. By adding the login portlet to an iFrame HTML element, the browser transfers the user to a logged-in ServiceNow session once the login is validated.

iFrame best practice

Do not embed any ServiceNow content—except the login portlet, shown above—in an external iFrame. Instead, link directly to the content in your ServiceNow instance.

--

Behind the scenes here at ServiceNow, the Knowledge Management and Multimedia teams work closely with subject matter experts to disseminate critical information to our customers. We've found that certain topics come up frequently, in the form of best practices that can help you keep your ServiceNow instances running smoothly. This series aims to target those topics so that you and your organization can benefit from our collective expertise. If you have a best practices topic you'd like us to cover in this series, please let us know in the comments below.

See Annotate scripts and customizations with comments for the first installment on script comments.

See Limit the number of users with the Admin role for the second installment on user roles.

See Where to avoid linking to a reference field when configuring a list for the third installment on list configuration.

See Developing on your production instance for the fourth installment on development.

See When to create a new table vs. when to extend for the fifth installment on application development.

SeeHow to clone to a target instance that has in-development applications for the sixth installment on cloning.

To access all of the blog posts in this series, search for "nowsupport best practices series."