13

I have two different developer orgs. One contains apex REST web service, and I want to call that REST service from my second org. I have tried to call that REST service using normal ajax post request and forcetk.js, But I got following error

XMLHttpRequest cannot load https://ap1.salesforce.com/services/apexrest/CustomSettings. Origin https://c.ap1.visual.force.com is not allowed by Access-Control-Allow-Origin.

I searched about this problem then I got to know that Salesforce never allows CORS (Cross-Origin-Resource-Sharing).

Initially I was using apex to call that REST web service, that time I was able to post data from apex. But as we have callout limitation in salesforce, I want to use javascript.

Can anybody please help me?

12

Finally, I solved the problem. I'm pasting my code here for reference

    var result = sforce.connection.login("myname@mymail.com", "mypassword+mysecurityToken");
    sforce.connection.init('{!sessionId}', 'REST web service url'); // here pass current session id of the org from which you are making request.

    sforce.connection.remoteFunction({
           url : REST web service url,
           requestHeaders: {"Authorization":"Bearer "+result.sessionId, "Content-Type":"application/json"}, // here pass the session id of the org in which you have your REST service
           requestData: data to post in JSON format,
           method: "POST",
           onSuccess : function(response) {
                  console.log(response);
              },
           onFailure : function(response) {
                  alert("Failed" + response)
              }
       });
  • I Have followed the same way u have done. If there is no request data means what we have to give for "requestData" key? – Dinesh Sep 27 '13 at 8:02
  • Hi Dinesh, Sorry for replying you late. If you don't have any data to post, just remove requestData field from code or put empty string as a data to it. – Tushar Kumawat Oct 4 '13 at 6:31
  • Hi,With the help of your post and little help over stackexchange i did the service call successfully. – Dinesh Oct 4 '13 at 10:04
  • @TusharKumawat sforce is an object of which class? – ta-run Feb 27 '15 at 13:19
1

Another option would be to use ForceTK

  • I tried using ForceTK but getting same error as I mentioned in my question. (I've mentioned about ForceTK in my question.) – Tushar Kumawat Jul 4 '13 at 11:21
0

You could use the sforce.connection.remoteFunction funciton from the ajax tookit to get the data from external servers. You will not get the cross-orign policy error.

  • Yes, I did try sforce.connection.remoteFunction, but it is returning me '401 Unauthorized' error. – Tushar Kumawat Jul 4 '13 at 7:30
  • Have you added the domain ( ap1.salesforce.com) in the Remote site setting?? – Sam Jul 4 '13 at 7:35
  • Yes, I have added https://ap1.salesforce.com/ in my Remote site setting. – Tushar Kumawat Jul 4 '13 at 7:40
  • Are you setting either a session id or oAuth token in the header to authenticate access to the other org? – Andrew Fawcett Jul 4 '13 at 8:12
  • @AndrewFawcett : Yes Andrew, I'm adding session Id in header. Initially I'm logging in to different org using sforce.connection.login. And after getting session Id from login result, I'm passing that session Id in header for authentication. – Tushar Kumawat Jul 4 '13 at 8:26
0

I've not tried this but could you create a sites website and add your webservice class to that then use the full url to connect to the webservice?

You'd need to put in some sort of authentication/security as the url is public but you should be able to come up with a simple password/token implementation.

  • YOu can find more info about this method here wadewegner.com/2013/03/… – Sam Jul 4 '13 at 10:02
  • I think this solution also not work for me, as salesforce is denying cross-domain requests. And if I create any website for hosting web service then also I need to use different url other than salesforce url. But I'll surely try this solution out. – Tushar Kumawat Jul 4 '13 at 11:54
0

You can get around this by adding a CORS whitelist entry (setup -> Security Controls -> CORS) for the https://[YOUR_SF_ORG].visual.force.com host.

For example, in the case of the Question author, you would just need to whitelist https://c.ap1.visual.force.com.

I don't think this opens any real security holes, but I can't say for sure (XSS might be possible from other ORGs on the same pod?). It's probably safer to use when the ORG has My Domain setup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.