Context: We are trying to call a outbound webservice directly from a lightning component in order to avoid wasting too much resources on calls to the APEX and the target webservice (auto-completion feature on a search bar).

The outbound call to the endpoint from APEX works succesfully. We are trying to reproduce it from client side in lightning.

What was done: We managed to configure the CSP, execute a 'simple' outbound call, solved all certificates issues.

The Issue: The call ends up in a 403 error. According to chrome console, the header of the request is not set at all using the method setRequestHeader (xmlHttpRequest Object).

As the endpoint is secured, we need to set the 'Authorization' part of the header in order to solve this error 403 (IMHO).


  • Did we miss any requirement in order to be able to use the setRequestHeader method in a Lightning component (setup, an implements something, ...)?
  • In a case in which the setRequestHeader function is blocked for an outbound call from a Lightning component, is there any trick/hack that would allow to call a securized endpoint ?

Code Snippet (js, ports and urls and pwd have been modified)

callFromJs : function(component, event, helper) {

    var httpXml = new XMLHttpRequest();
    var endPoint = "https://confidentialurl:42424/servicename/operation?arg1=toto";

    httpXml.open("GET", endpoint, false);

    httpXml.setRequestHeader("Accept", "application/json");

    httpXml.setRequestHeader("Authorization", "Basic " + btoa("usr:pwd"));


As highlighted by manjit,

The issue was caused by our source domain not declared in the CORS.

As the source domain wasn't declared in the CORS, the browser wouldn't allow us to insert the header we needed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.