We are integrating a lightning out component into an external web page. We are using the the user agent style of oauth authentication.The component seems to work fine, however after an hour of non-use (because the salesforce session times out) any subsequent requests made by the component (back to salesforce) show 500 errors in the browser dev tools. The response body for these requests is actually


"event": {"descriptor":"markup://aura:invalidSession","attributes":{"values":{}},

I am not a salesforce developer and have no salesforce experience, but it looks to me like this response body should be run by the calling Lightning js and perhaps reload the page (window.location.reload(true);) which would start the authentication flow again - this would be good. However this code never seems to be executed as the page does not get reloaded.

I have also included some chrome console logs

chrome console

This shows CORS issues, which I don't fully understand because CORS has been configured in the salesforce console and there are no CORS issues when using the lightning component at other times. Note: when I disabled CORS in safari, the page seems to get reloaded, and authentication occurs as one would hope. So it seems that CORS is somehow involved.

1 Answer 1


I had the same kind of issue where I could see the pre-flight OPTIONS request getting the correct CORS response headers and seeing the real GET request failing with the browser reporting this as a CORS issue. The server error 500 is what you really need to pay attention to (I had the same error and got side tracked by the CORS error in the browser log).

In my case it was a url/domain issue. I used the instance url that I got back from a logon call to try to load the Lightning Out component from (kind of the natural thing to do), but it turned out that this url was a bit different than the component should be loaded from. The solution was to replace the domain returned from login with the correct domain and use the mapped url to load the component. The mapping was like:

url = url.replace("xyz--DEV01.cs89.my.salesforce.com", "xyz--dev01.lightning.force.com");

Try to open your Dependency App in the developer console and preview it - it will not load, but it will show you the url the preview tries to load it from.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .