I'm having an issue with CORS where I'm unable to make a POST request to a Salesforce site from another site, but one I have listed in my CORS whitelist. Not sure if I have something set up wrong, or if there's just something I'm not understanding about CORS.

So the scenario I have is I have a jQuery ajax call like this:

    url: "https://sf-site-here.na34.force.com/pageName",
    type: "POST",
    dataType: "json",

From, say, external.site.com. I've added https://external.site.com to my CORS whitelist, but when I try to make the POST (which is for a jQuery autocomplete, just for a little bit more context) I still get

XMLHttpRequest cannot load https://sf-site-here.na34.force.com/pageName. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://external.site.com' is therefore not allowed access.

The page I'm trying to access is a VF page that returns a json string. It's a VF page with contentType="application/x-JavaScript; charset=utf-8". I'm trying to access the page via sites.

Am I misunderstanding what that whitelist applies to? Does it only work for certain calls, or is there something else I need to set up on the site?

  • Can you try adding https://sf-site-here.na34.force.com to the whitelist instead of https://external.site.com ?
    – javanoob
    Feb 27, 2017 at 18:52
  • @javanoob I could try it, but I don't see why salesforce would need to whitelist itself... Feb 27, 2017 at 18:55
  • Do the domain of the calling page and called page match? The error you are getting is not thrown by salesforce but by the browser. Check this to understand more about CORS : html5rocks.com/en/tutorials/cors
    – javanoob
    Feb 27, 2017 at 18:58
  • 1
    The domains are completely different, the external.site.com is not a SF site. It was my understanding, though, that the point of the CORS whitelist was telling SF which external domains it could trust a call from. The example here has the external site be a completely separate site: developer.salesforce.com/blogs/developer-relations/2015/01/… Feb 27, 2017 at 19:03
  • My bad. You need to whitelist(as you already did) https://external.site.com in salesforce not https://sf-site-here.na34.force.com. Please ignore my first comment.
    – javanoob
    Feb 27, 2017 at 19:07

1 Answer 1


Ok. I did some research on this and looks like we both interpreted the Salesforce CORS documentation wrongly.

Salesforce CORS says that CORS is only for making requests to Supported Salesforce APIs, Apex REST, and Lightning Out but not for making calls to Salesforce pages(as you are trying to do) because that is not exposed an API.

I created a simple jsfiddle to prove this further and my understanding is correct.

  1. Created a simple public REST API on my developer edition org as explained in this link.
  2. Whitelisted jsfiddle in my org under CORS.

If I make calls from jsfiddle, a request goes through fine and response is returned.

If I undo the whitelisting of jsfiddle in my org, the request fails(with the same error message as you are getting) proving that CORS is needed for the request to work.

I think for your case, you need to create a REST API and make calls to it by whitelisting the calling page.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.