4

I have built a dependency app using extends="ltng:outApp" that is hosted on heroku. It runs on an express node.js server and I use salesforce-oauth2-flow. Lets call it myApp

myApp is whitelisted in CORS settings as https://myApp.herokuapp.com and it loads fine and is fully functional with Locker Service disabled and Locker Service enabled, too, except one: myApp references a static resource.

For that I use 

ltng:require scripts="<ltng:require scripts="{!'https://my-instance.lightning.force.com'+$Resource.customResource}"
        afterScriptsLoaded="{!c.onLoaded}" />"

After turning Locker Service on, the component works fine in my own developer org.

Authentication, loading and displaying the component does also work on heroku.

But with Locker Service on I fail to load the static resource referenced within the component: 

XMLHttpRequest cannot load https://my-instance.lightning.force.com/resource/1484XXXX0000/customResource. 
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'https://myApp.herokuapp.com' is therefore not allowed access.

How can I load the static resource successfully in this context?

Improve this question
5
  • 1
    Did you add the VF URL to the CORS listing? https://my-instance.lightning.force.com or simply use /resource/xyz/abc.js in the scripts variable (that worked for me and I did not need to add to CORS)
    – Eric
    Commented Jan 16, 2017 at 1:05
  • Try this: <ltng:require scripts="{!$Resource.customResource}" afterScriptsLoaded="{!c.onLoaded}" />"
    – itzmukeshy7
    Commented Jan 16, 2017 at 6:04
  • I have added the/all VF URL to CORS before posting. No dice. Hardcoing complete URI results in the same error. Using $Resource purely or a relative path results in heroku trying to load the resource locally - which results in 404.
    – Christian Szandor Knapp
    Commented Jan 16, 2017 at 8:35
  • I'm having this same issue. Is there somewhere I can track the fix progress for this publicly? Is there a timeframe for a fix?
    – Jesse McGeachie
    Commented Jan 23, 2017 at 20:38
  • 1
    @Jesse backport request (already fixed in future release) for not loading safeEval when not-needed (as long as container of LO is not enforcing strict CSP rules around no unsafe-inline/unsafe-eval) is being tracked via W-3674198. By the way, this only impacts DE and sandbox orgs. What kind of org do you have? Also if you share your orgId, our PM (Farhan Tahir) can temporarily disable safeEval setting for you (so that you don't have to disable Locker CRUC entirely).
    – Emad Salman
    Commented Feb 17, 2017 at 22:21

1 Answer 1

Reset to default
2

It appears that $resource is not correctly absolutizing URLs like it is supposed to - known bug tracking this is W-3633321. This issue is not specific to Locker however.

There is another issue recently identified in the newly introduced work to support removal of CSP unsafe-inline/eval that is related in that it's another relative versus absolute URL generation issue (for safeEval.html) that only manifests at the intersection of LO/Locker (does not impact Lightning Comps for VF because there is a single domain in play in that use of LO).

We are working on fixes for both.

Improve this answer
3
  • Is this issue fixed now? I'm having some difficulty with Lightning Out in VF, and I wonder if this might be the cause. Thanks!
    – Aidan
    Commented Jul 14, 2017 at 12:17
  • is this fixed? I am using leaflet in lightning component and that is getting loaded on the external website using lightning out. I have added salesforce instance domain in CORS as well.
    – Jai Chaturvedi
    Commented Aug 20, 2017 at 8:05
  • 2
    This is still an issue, even after release of W-3633321. Has anyone else been able to get this to work successfully with Locker Service enabled using ltng:require ?
    – zachelrath
    Commented Feb 9, 2018 at 21:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .