I have lightning component for working with amazon s3. I generating unsigned url in apex controller and then try load file using XmlHttpRequest to Amazon. I added "https://my-bucket.s3.amazonaws.com" to CPS Trusted Sites. And added my sf org in S3 cors:


And then from lightning controller try load file:

    var loadPdfRequest = new XMLHttpRequest();
    loadPdfRequest.open('GET', unsignedUrl);

And i fetch:

XMLHttpRequest cannot load https://my-bucket.s3.amazonaws.com/folder_1/myFile.pdf?AWSAccessKeyId=MyAccessKey&Expires=1507207939&Signature=Signature. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://my-dev-ed.lightning.force.com' is therefore not allowed access.

What I am doing wrong? Maybe Locker Service? My component version is 39.0

  • Have you added this site into trusted sites? Oct 5, 2017 at 13:44
  • Yes of course I added
    – JKasyan
    Oct 5, 2017 at 13:49

1 Answer 1


You seem to have added the non-lightning domain in your CORSRule. You should also add the lightning domain.

CORSRule has <AllowedOrigin>https://my-dev-ed.my.salesforce.com</AllowedOrigin>

But your lightning page is loaded from a different domain 'https://my-dev-ed.lightning.force.com'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .