The original problem is that one of our customers can't use our VF component in their org because of
Access to XMLHttpRequest at 'https://c.xNN.visual.force.com/apex/yourpath' from origin 'https://xNN.salesforce.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
I have to mention that component has its own controller which is also suppled in the package.
I've tried to reproduce the problem in our orgs but no luck - everything works just fine. After a brief investigation I found that we have all VF component sources hosted on
force.com domain, but customer has some data/sources hosted on 'salesforce.com' when another part is hosted on 'force.com'.
Can someone explain the difference between
force.com, and why this problem occurs only for one customer. Is there any setting I could miss that lead to this problem?
Visualforce Page looks like