Cross Origin Domain Problem on Apex Rest Method

Question

I have been using custom rest method for long time for file uploading and it was working properly. however last week , it started to throw error where the request is send. I have rest method in class to upload files in content.

Here is my rest method that is invoked on http post.

@RestResource(urlMapping='/attach')
global with sharing class RestContentUploader

{

@HttpPost
global static String attach(){

     RestRequest req = RestContext.request;
     RestResponse res = RestContext.response;
     //res.addHeader('Content-Type', 'application/json');
     //res.addHeader('Access-Control-Allow-Origin','https://mds.na15.visual.force.com');
     res.statusCode =200;
     String upload_pid,upload_filename,upload_recordtype,upload_libraryId,upload_docId,specialties,subspecialties,fileIdentity,fileSubId,date_value;
     Boolean is_Client_Document=true;
     Boolean is_hidden;
     //Request Header parameters;
     upload_pid = RestContentUploader.decodeURLParam(req.headers.get('upload_pid'));
     upload_filename = RestContentUploader.decodeURLParam(req.headers.get('upload_filename'));
     upload_recordtype = RestContentUploader.decodeURLParam(req.headers.get('upload_recordtype'));
     upload_libraryId = RestContentUploader.decodeURLParam(req.headers.get('upload_libraryId'));
     upload_docId = RestContentUploader.decodeURLParam(req.headers.get('upload_docId'));
     specialties = RestContentUploader.decodeURLParam(req.headers.get('specialties'));
     subspecialties = RestContentUploader.decodeURLParam(req.headers.get('subspecialties'));
     fileIdentity = RestContentUploader.decodeURLParam(req.headers.get('fileIdentity'));
     fileSubId = RestContentUploader.decodeURLParam(req.headers.get('fileSubId'));
     date_value = RestContentUploader.decodeURLParam(req.headers.get('date_value'));
     is_hidden = RestContentUploader.decodeURLParam(req.headers.get('ishidden'))=='true' ? true : false ; 
     is_Client_Document = RestContentUploader.decodeURLParam(req.headers.get('isclient'))=='true' ? true :false;


    Blob bin= req.requestBody;

    if( String.isBlank(upload_pid)|| String.isBlank(upload_filename)|| String.isBlank(upload_recordtype) || String.isBlank(upload_libraryId)){
        res.statusCode = 400;
        return 'missing upload headers';
    }
    //Removed the logic due to wrong versioning 01/08/2014
    // if(upload_docId== '' || upload_docId== null)

      try
      {
        ContentVersion att = new ContentVersion (
            Authorization__c = upload_pid,
            VersionData= bin,
            PathOnClient= upload_filename,
            Title= upload_filename,
            FirstPublishLocationId=upload_libraryId,
            RecordTypeId=upload_recordtype,
            Specialties__c= specialties,
            FileSubIdentity__c=fileSubId,
            FileIdentity__c=fileIdentity,
            Subspecialties__c=subspecialties,
            DateSpecifier__c=(String.isEmpty(date_value) ? null :Date.parse(date_value)),
            Client_Document__c=is_Client_Document,
            IsHidden__c=is_hidden
        );
        system.debug('ContentVersion Initialize====>'+att);

        insert att;

        //Return the new attachment Id
        res.addHeader('fileName', att.Title);
        return att.Id;
      }
      catch(exception xx)
      {
        system.debug('***RESPONSE XX***'+res);
        res.statusCode = 400;
        res.addHeader('fileName', upload_filename);

        system.debug('***RESPONSE XX22***'+res);
        return xx.getMessage();
      } 


} 
public static string decodeURLParam(string param){
    return String.isBlank(param) ? null : EncodingUtil.urlDecode(param,'UTF-8');
}


}

Im using jquery file upload library and here is the piece of script codes which request is sent.

 $('#'+fileInputId).fileupload('send',{
                       files:data.files,
                       beforeSend : function(xhr) {
                            xhr.setRequestHeader('Authorization', 'Bearer {!$Api.Session_ID}');
                            xhr.setRequestHeader('SalesforceProxy-Endpoint',{!fileInputHtmlId}_restUrl);
                            xhr.setRequestHeader('X-User-Agent', 'salesforce-toolkit-rest-javascript/v36.0');
                            xhr.setRequestHeader('upload_filename',fileName);
                            xhr.setRequestHeader('upload_pid','{!parentId}');
                            xhr.setRequestHeader('upload_libraryId','{!libraryId}');
                            xhr.setRequestHeader('upload_docId','{!contentDocumentId}');
                            xhr.setRequestHeader('upload_recordtype','{!recordTypeId}');
                            xhr.setRequestHeader('isclient',{!isClient});
                            xhr.setRequestHeader('ishidden',document.getElementById('{!fileInputHtmlId}_'+removeWhiteSpace(removeDots(fileName))+'_check').checked);
                        }
                 });//fileUpload

I have tried many things, i have added origin domain in CORS, i have manipulated response headers as adding Access-Control-Allow-Origin header, they all do not work.

Here is my CORS list.

And here is the error that im getting on client side!!

Are there anyone who is having same issue ? Any suggestion or workaround would be great!

Thanks

Answer 1

Salesforce is aware of the issue, and is trying to determine the root cause. Basically, the Salesforce AJAX proxy is dropping the Authentication header, which causes the API to return a 401 Not Authorized error. You should log a case with support so they can notify you of the problem once it is resolved and keep track of how many customers are affected.

---

Edit #1:

Salesforce is pushing out a hot fix this weekend for the problem. Everything should be just fine by Monday morning. If you continue to experience problems, please feel free to let us know.

---

Edit #2:

We now also have a Known Issue logged for this.