13

I have two different developer orgs. One contains apex REST web service, and I want to call that REST service from my second org. I have tried to call that REST service using normal ajax post request and forcetk.js, But I got following error

XMLHttpRequest cannot load https://ap1.salesforce.com/services/apexrest/CustomSettings. Origin https://c.ap1.visual.force.com is not allowed by Access-Control-Allow-Origin.

I searched about this problem then I got to know that Salesforce never allows CORS (Cross-Origin-Resource-Sharing).

Initially I was using apex to call that REST web service, that time I was able to post data from apex. But as we have callout limitation in salesforce, I want to use javascript.

Can anybody please help me?

Improve this question

5 Answers 5

Reset to default
12

Finally, I solved the problem. I'm pasting my code here for reference

    var result = sforce.connection.login("[email protected]", "mypassword+mysecurityToken");
    sforce.connection.init('{!sessionId}', 'REST web service url'); // here pass current session id of the org from which you are making request.

    sforce.connection.remoteFunction({
           url : REST web service url,
           requestHeaders: {"Authorization":"Bearer "+result.sessionId, "Content-Type":"application/json"}, // here pass the session id of the org in which you have your REST service
           requestData: data to post in JSON format,
           method: "POST",
           onSuccess : function(response) {
                  console.log(response);
              },
           onFailure : function(response) {
                  alert("Failed" + response)
              }
       });
Improve this answer
4
  • I Have followed the same way u have done. If there is no request data means what we have to give for "requestData" key?
    – Dinesh
    Commented Sep 27, 2013 at 8:02
  • Hi Dinesh, Sorry for replying you late. If you don't have any data to post, just remove requestData field from code or put empty string as a data to it.
    – Tushar Kumawat
    Commented Oct 4, 2013 at 6:31
  • Hi,With the help of your post and little help over stackexchange i did the service call successfully.
    – Dinesh
    Commented Oct 4, 2013 at 10:04
  • @TusharKumawat sforce is an object of which class?
    – painotpi
    Commented Feb 27, 2015 at 13:19
1

Another option would be to use ForceTK

Improve this answer
1
  • I tried using ForceTK but getting same error as I mentioned in my question. (I've mentioned about ForceTK in my question.)
    – Tushar Kumawat
    Commented Jul 4, 2013 at 11:21
0

You could use the sforce.connection.remoteFunction funciton from the ajax tookit to get the data from external servers. You will not get the cross-orign policy error.

Improve this answer
7
  • Yes, I did try sforce.connection.remoteFunction, but it is returning me '401 Unauthorized' error.
    – Tushar Kumawat
    Commented Jul 4, 2013 at 7:30
  • Have you added the domain ( ap1.salesforce.com) in the Remote site setting??
    – Sam
    Commented Jul 4, 2013 at 7:35
  • Yes, I have added https://ap1.salesforce.com/ in my Remote site setting.
    – Tushar Kumawat
    Commented Jul 4, 2013 at 7:40
  • Are you setting either a session id or oAuth token in the header to authenticate access to the other org?
    – Andrew Fawcett
    Commented Jul 4, 2013 at 8:12
  • @AndrewFawcett : Yes Andrew, I'm adding session Id in header. Initially I'm logging in to different org using sforce.connection.login. And after getting session Id from login result, I'm passing that session Id in header for authentication.
    – Tushar Kumawat
    Commented Jul 4, 2013 at 8:26
0

I've not tried this but could you create a sites website and add your webservice class to that then use the full url to connect to the webservice?

You'd need to put in some sort of authentication/security as the url is public but you should be able to come up with a simple password/token implementation.

Improve this answer
2
  • YOu can find more info about this method here wadewegner.com/2013/03/…
    – Sam
    Commented Jul 4, 2013 at 10:02
  • I think this solution also not work for me, as salesforce is denying cross-domain requests. And if I create any website for hosting web service then also I need to use different url other than salesforce url. But I'll surely try this solution out.
    – Tushar Kumawat
    Commented Jul 4, 2013 at 11:54
0

You can get around this by adding a CORS whitelist entry (setup -> Security Controls -> CORS) for the https://[YOUR_SF_ORG].visual.force.com host.

For example, in the case of the Question author, you would just need to whitelist https://c.ap1.visual.force.com.

I don't think this opens any real security holes, but I can't say for sure (XSS might be possible from other ORGs on the same pod?). It's probably safer to use when the ORG has My Domain setup.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .