I have a script which is hosted on visualforce page. This script should be called from external website. Is it possible to all Apex/Visualforce page from external website without authentication? Using XHR call?

    var xmlhttp;
    if (window.XMLHttpRequest) { // code for IE7+, Firefox, Chrome, Opera, Safari
        xmlhttp=new XMLHttpRequest();
    } else { // code for IE6, IE5
        xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
    xmlhttp.onreadystatechange = function() {
        if (xmlhttp.readyState==4 && xmlhttp.status==200) {
    xmlhttp.open("GET","Apex/visualforce page url",false);
  • 5
    By the way, this is 2018. It's time to stop supporting IE 6. – sfdcfox Jun 8 '18 at 18:35
  • @Chaithra K N, remember to accept the answer if it proved useful, you have several posts with asnwers that have not been accepted. thanks – glls Oct 15 '18 at 19:35

Yes. You'll need to first set up a Site in Salesforce, enable that Visualforce page for the Site, add CORS settings so your external site will be allowed JavaScript access, and then everything should work. You can do a similar trick with an Apex class, using either the RestResource annotation or the webservice keyword. Make sure you validate your input carefully, for security reasons. It's generally not a good idea to do this; you really should consider calling back to your server, having your server authenticate as an integration user, so you can control security better.

|improve this answer|||||
  • I totally agree for the security reason, but we are just documenting possible options for calling sf resource from external site.If you have any code snippet for this can you paste? I tried adding site visualforce page in the xmlhttp.open method. – Chaithra K N Jun 9 '18 at 3:56
  • Also the site which is calling VF and site domain is different. I was using below code to call VF page from XHR call. xmlhttp.open("GET","demositechaithra-developer-edition.ap5.force.com/",false); TestAPI.html:15 Failed to load demositechaithra-developer-edition.ap5.force.com: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. – Chaithra K N Jun 9 '18 at 4:11
  • (anonymous) @ TestAPI.html:15 TestAPI.html:15 Uncaught DOMException: Failed to execute 'send' on 'XMLHttpRequest': Failed to load 'demositechaithra-developer-edition.ap5.force.com'. at file:///C:/Users/ChaithraNagaraj/Desktop/TestAPI.html:15:10 – Chaithra K N Jun 9 '18 at 4:11
  • @ChaithraKN Okay, so my answer was (partially) incorrect. You need to be authenticated in order to get CORS to work, and it only works with a limited list of items. So, ultimately, you'll need to go through your server anyways. – sfdcfox Jun 9 '18 at 4:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.