I have a requirement where I need to call my custom written Apex REST api from java-script in visualforce page, But somehow I'm getting that CORS issue which says my request has been blocked due to following error:

No 'Access-Control-Allow-Origin' header is present on the requested resource

I know now it shouldn't throw any kind of CORS issue, because as per summer 16 release CORS is supported by Apex REST service, refer below post: https://releasenotes.docs.salesforce.com/en-us/summer16/release-notes/rn_apex_rest_cors.htm

And I already added request origin url (which is VF) in the CORS settings, Setup >> CORS

Second weird thing is it always show me GET call in the dev console, although I'm making a POST call in the API, may be it because of any redirection behavior. Please find error screenshot from my dev console. enter image description here

Can anyone suggests what's gone wrong here.


CORS in Salesforce is all kinds of messed up... The standard REST API (services/data) works fine in most cases (you actually don't even need CORS).

However, when send a request to https://yourdomain.visualforce.com/services/apexrest/*, salesforce will 301 redirect you to https://yourdomain.salesforce.com/services/apexrest/*.

Unfortunately when it does this, it doesn't seem to preserve the http method (POST in this case) and always redirects to GET.

You can solve this by instead just sending your requests directly to https://yourdomain.salesforce.com/ in the first place. You will of course, need a CORS whitelist for https://yourdomain.visualforce.com.

TIP: You can get the standard URL of your ORG in visualforce like this:

 <script type="text/javascript">    
      const restHost = '{!URLFOR("/", null)}';
      const accessToken = '{!$Api.Session_ID}';
  • 1
    Thanks! it will help someone else here. – user2809299 May 25 at 7:02

Apex REST service requires you to use OAuth tokens and are meant to be used more by services outside Salesforce. If you read the release note you posted in your question you can see in the bottom: "You must still pass an OAuth token with requests that require it."

What you can do is create a VisualForce page that outputs the JSON(or whatever output you want) and request with your JavaScript using the path: {!$Page.ThePageNameYouJustCreated}. That way you don't have to worry about CORS at all since it will be on the same domain you are requesting from.

You need to give more info about the POST request always being GET, but from the information you gave it seems you are not constructing the request correctly.

  • You are right in saying that, but in my case, I'm using a third party Js framework who actually doing the API call, the only control I have there is to provide the URL which should be called and the response which is coming from the API call. If I expose a VF page and then from that another VF page I called my REST service it will work, but that would always be a GET call to my visual-force page. in my case that third party library always do a POST call, so how can we handle that situation. – user2809299 Dec 31 '18 at 6:36
  • One more thing, which I did here I changed the endpoint Url to salesforce standard REST API Url and checked the network tab in dev console. i found it is making POST call, so no issue with the request forming. – user2809299 Jan 3 at 7:36
  • What ever tool you are using you will need OAuth tokens to make requests to the Apex REST service. Only exception to this is if you will expose the Apex REST Service as a public user in force.com sites but that will allow unauthenticated users to make requests to the API: developer.salesforce.com/docs/atlas.en-us.apexcode.meta/… You don't need the REST service if you create the VF page, you just make the POST request straight to the VF page. You would be essentially creating a VF REST Api. – Skarpi Steinthorsson Jan 4 at 10:34
  • Yes, I'm passing auth token with the request. But still it is not clear how can you send a POST call to a VF page? have you tried it? – user2809299 Jan 4 at 11:21
  • 1
    The part about needed oAuth tokens is incorrect (mostly). You can absolutely use the {!$Api.Session_ID} – NSjonas May 23 at 3:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.