The original problem is that one of our customers can't use our VF component in their org because of

Access to XMLHttpRequest at 'https://c.xNN.visual.force.com/apex/yourpath' from origin 'https://xNN.salesforce.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I have to mention that component has its own controller which is also suppled in the package.

I've tried to reproduce the problem in our orgs but no luck - everything works just fine. After a brief investigation I found that we have all VF component sources hosted on force.com domain, but customer has some data/sources hosted on 'salesforce.com' when another part is hosted on 'force.com'.

Can someone explain the difference between salesforce.com and force.com, and why this problem occurs only for one customer. Is there any setting I could miss that lead to this problem?


Visualforce Page looks like

<apex:page standardController="Account">
    <pkg_namespace:TheirComponent />
  • Is your component designed to be used as an XHR? What structure of data does it return? (e.g JSON, String, XML, etc.)
    – Nick C
    Apr 4, 2019 at 23:01
  • @NickCook, it returns a html, and placed on the customers visualforce page. In fact visualforce page renderened on the layout within iframe. So i've tried to add Access-Control-Allow-Origin header, but no luck Apr 5, 2019 at 8:14


You must log in to answer this question.

Browse other questions tagged .