I have built a dependency app using extends="ltng:outApp" that is hosted on heroku. It runs on an express node.js server and I use salesforce-oauth2-flow. Lets call it myApp

myApp is whitelisted in CORS settings as https://myApp.herokuapp.com and it loads fine and is fully functional with Locker Service disabled and Locker Service enabled, too, except one: myApp references a static resource.

For that I use

ltng:require scripts="<ltng:require scripts="{!'https://my-instance.lightning.force.com'+$Resource.customResource}"
        afterScriptsLoaded="{!c.onLoaded}" />"

After turning Locker Service on, the component works fine in my own developer org.

Authentication, loading and displaying the component does also work on heroku.

But with Locker Service on I fail to load the static resource referenced within the component:

XMLHttpRequest cannot load https://my-instance.lightning.force.com/resource/1484XXXX0000/customResource. 
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'https://myApp.herokuapp.com' is therefore not allowed access.

How can I load the static resource successfully in this context?

  • 1
    Did you add the VF URL to the CORS listing? https://my-instance.lightning.force.com or simply use /resource/xyz/abc.js in the scripts variable (that worked for me and I did not need to add to CORS) – Eric Jan 16 '17 at 1:05
  • Try this: <ltng:require scripts="{!$Resource.customResource}" afterScriptsLoaded="{!c.onLoaded}" />" – itzmukeshy7 Jan 16 '17 at 6:04
  • I have added the/all VF URL to CORS before posting. No dice. Hardcoing complete URI results in the same error. Using $Resource purely or a relative path results in heroku trying to load the resource locally - which results in 404. – Christian Szandor Knapp Jan 16 '17 at 8:35
  • I'm having this same issue. Is there somewhere I can track the fix progress for this publicly? Is there a timeframe for a fix? – Jesse McGeachie Jan 23 '17 at 20:38
  • 1
    @Jesse backport request (already fixed in future release) for not loading safeEval when not-needed (as long as container of LO is not enforcing strict CSP rules around no unsafe-inline/unsafe-eval) is being tracked via W-3674198. By the way, this only impacts DE and sandbox orgs. What kind of org do you have? Also if you share your orgId, our PM (Farhan Tahir) can temporarily disable safeEval setting for you (so that you don't have to disable Locker CRUC entirely). – Emad Salman Feb 17 '17 at 22:21

It appears that $resource is not correctly absolutizing URLs like it is supposed to - known bug tracking this is W-3633321. This issue is not specific to Locker however.

There is another issue recently identified in the newly introduced work to support removal of CSP unsafe-inline/eval that is related in that it's another relative versus absolute URL generation issue (for safeEval.html) that only manifests at the intersection of LO/Locker (does not impact Lightning Comps for VF because there is a single domain in play in that use of LO).

We are working on fixes for both.

  • Is this issue fixed now? I'm having some difficulty with Lightning Out in VF, and I wonder if this might be the cause. Thanks! – Aidan Jul 14 '17 at 12:17
  • is this fixed? I am using leaflet in lightning component and that is getting loaded on the external website using lightning out. I have added salesforce instance domain in CORS as well. – Jai Chaturvedi Aug 20 '17 at 8:05
  • 2
    This is still an issue, even after release of W-3633321. Has anyone else been able to get this to work successfully with Locker Service enabled using ltng:require ? – zachelrath Feb 9 '18 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.