Lightning Out 403

Question

I have a Visualforce page that is used in a post-chat survey URL.

The page uses Lightning out to embed an aura component that calls an LWC:

<apex:includeLightning />
<script>
        $Lightning.use("c:SurveyAuraHandler", function() {
            $Lightning.createComponent("c:survey",
                {
                    Id : '{!$CurrentPage.parameters.chatKey}'
                },
                "survey",
                function(cmp) {
                    document.getElementById('{!$Component.Survey.form.spinner}').classList.add('slds-hide');
                }
            );
        });
    </script>

<aura:application access="GLOBAL" extends="ltng:outApp" implements="ltng:allowGuestAccess">
    <aura:dependency resource="c:survey"/>
</aura:application>

The whole components chain is called in an Experience Cloud / Community that uses Live Agent (Embedded Service Deployment). After the live chat session is over a feedback page (the visualforce page) is called. Now when the page is called in a community everything works fine, the components render properly. However when the community uses a custom domain I get 403 error when the visualforce page tries to embed the aura and lwc components.

I've added permissions to all relevant objects to the Guest users including access to the VF page and controller but nothing works.

Would love ANY suggestions on what could be causing it.

Answer 1

I was able to find out what the issue was.

Once I clicked through one of the links that were erroring and opened them in a new tab, I saw that before serving the content, I was forced through a security check by Cloudflare. All I had to do was to just whitelist the URLs in Cloudflare and Lightning Out was working once again.