I have a Drupal 7 site with a custom blog created with custom content types and a combination of views. I need to be able to export this blog as an iframe with a "long security token" to be used on a Salesforce site. I have read about several modules that can generate iframes, but I'm not sure how to go about the security side of things. Any suggestions? I've looked into the Entity Iframe project, and this seems to do what I want for individual nodes, but I'm not sure how to do this for the whole view/page.

A more involved alternative can be found here Drupal Iframe Widgets but this doesn't deal with the security side of things.

So, my questions remains: what's the best/easiest way to export a view to another site with a security token?

up vote 1 down vote accepted

If you add ?entity_iframe to the url it'll trigger the iframe theme. Entity iframe resize has examples of how to do cross domain communications (assuming sub-domains) securely and with less complexity then the provider / consumer handshake via the PostMessage capability built into browsers (http://caniuse.com/#search=postmessage)

Hope this helps. :)

  • Hi thanks for your answer, sorry I've taken so long to respond I've been laid up for a while. What about if I need the cross-domain security in a non-subdomain context? will that still work? – nizz0k Sep 20 '17 at 17:16
  • Yes I think so. I have not tried to do that myself but you can test if it works 😀 – Jdrupal Sep 20 '17 at 17:27
  • So, the ?entity_iframe works, but I can't get it to load on another domain with just the embed code. Not sure where I'd have to implement the security token...also there doesn't seem to be an entity iframe resize module page. – nizz0k Sep 20 '17 at 17:38
  • Ok I'm sorry but I don't think that I can help you more than I have because I have not tried to do what you want before :-( – Jdrupal Sep 20 '17 at 17:51
  • Appreciate the help so far, it's pointed the right way – nizz0k Sep 20 '17 at 18:42

Pretty sure there are many ways to accomplish this, however seems to me the easiest method would be creating a custom module.

This simple module would be responsible for creating a dedicated path for your view, and checking the security token for determining the access to it.


 * Implements hook_menu().
function secret_blog_menu() {
  $items = array();

  $items['secret_blog/%'] = array(
    'title' => 'My Secret Blog',
    'type' => MENU_CALLBACK,
    'page callback' => 'secret_blog_page',
    'access callback' => 'secret_blog_access',
    'access arguments' => array(1),

  return $items;

 * Page callback.
function secret_blog_page() {
  $view = views_get_view('MACHINE_NAME_OF_YOUR_VIEW');
  $display_id = 'default';
  $args = array();
  $content = $view->execute_display($display_id, $args);

  $build['content'] = array(
    'secret_blog_view' => array('#markup' => $content),

  return $build;

 * Access callback.
function secret_blog_access($access_token = '') {
  if ($access_token == 'LONG_SECURITY_TOKEN') {
    return TRUE;
  else {
    return FALSE;

For this example let's assume your website is served at http://example.com and the blog view would be accessible at http://example.com/secret_blog/LONG_SECURITY_TOKEN

Now, you can provide that URL to Salesforce (or any 3rd party service) for embedding into it.

I suppose you would also need to use a different layout than the site default; you should create the necessary HTML and/or PAGE templates suiting to your needs. To find out proper template names enable theme debugging in settings.php file (this feature is available as of Drupal 7.33).

$conf['theme_debug'] = TRUE;

The suggested template names would be something like these:

  • html--secret-blog--LONG_SECURITY_TOKEN.tpl.php
  • page--secret-blog--LONG_SECURITY_TOKEN.tpl.php
  • Sorry it's taken me so long to check on this. Quick question about your solution: will the page callbacks allow content to be displayed that should be for logged in users only? – nizz0k Sep 20 '17 at 19:12
  • If you want to check against both conditions; you should update the statement like this: if (user_is_logged_in() && ($access_token == 'LONG_SECURITY_TOKEN')) – osman Sep 27 '17 at 5:07
  • I'm hoping to avoid users all together and just allow that single context to stay logged in so the authenticated users on the other site will have a seamless experience. As I'm just exposing a single view, I don't think there are huge security implications to expose it to anonymous views on a single path and iframe that, but I want to avoid the bad practice of sending credentials through the URL and my security requirement. My research suggests that maybe using oauth here would work, but I haven't seen a good example of how to actually set it all up for newbies... – nizz0k Sep 27 '17 at 8:33

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.