0

I have started to make a chrome extension for salesforce. I got this link to start off with. https://github.com/mwelburn/Chrome-Extension-Force-SOQL-Popup

This is a simple extension which queries the SOQL in the text area. It works fine if we are in the salesforce domain page - like the home page of salesforce but doesn't work when we are in a Visualforce domain.

It throws the exception of Status Code: 401 Unauthorised

Can anybody point out where I'm doing wrong?

EDIT: Posting the code for the connection -

function connection() {
    var session = document.cookie.match(/(^|;\s*)sid=(.+?);/)[2];

    jQuery.ajax({
        type: "GET",
        url: "/services/data/v24.0/query/?q=SELECT+Name+FROM+Account+LIMIT+5",
        beforeSend: function(xhr) {
            xhr.setRequestHeader('Authorization', "OAuth " + session);
            xhr.setRequestHeader('Accept', "application/json");
            xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
            xhr.setRequestHeader('Access-Control-Allow-Methods', 'GET');

        },
        success: function(data) {
            console.log("Success");
            console.log(data);
        }
    });
}

I call this javascript function to get the account records. The call is successful in case I'm in the salesforce home page. but fails when the extension is clicked when a visualforce is on the current window.

Adding few more details -

Comparing the REST request from the home page and a Visualforce page.

The below request is from a home page ---

Request URL: https://mylwc1-dev-ed.my.salesforce.com/services/data/v45.0/query/?q=SELECT+Name+FROM+Account+LIMIT+5

Accept: application/json
Accept-Encoding: gzip, deflate, br
Accept-Language: en-IN,en;q=0.9,en-GB;q=0.8,en-US;q=0.7
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Authorization: Bearer 00D2v000001dPB*******sP0DMh6wM

And this is from a visualforce page --

Request URL: https://mylwc1-dev-ed--c.visualforce.com/services/data/v45.0/query/?q=SELECT+Name+FROM+Account+LIMIT+5

Accept: application/json
Accept-Encoding: gzip, deflate, br
Accept-Language: en-IN,en;q=0.9,en-GB;q=0.8,en-US;q=0.7
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Authorization: Bearer 00D2v000001dPB*****NwJ_AUWioTuZM

Observe the access token from both the context. They are different. As per salesforce documentation, sessionId is different in a different context. So, in this case I'm unable to authorize my application from the sessionId from the Visualforce context.

2
  • 1
    I don't know how/what you are implementing, but Visualforce pages are not on the same domain as of Salesforce. May be you should consider that and have your REST callouts to work on both the domains. For more info., refer the solution from here.
    – SatyaV
    Sep 11, 2019 at 17:36
  • I have updated my question with the code. that is how I'm making the REST callout to salesforce. But this fails when it is on a visualforce page. Sep 11, 2019 at 17:46

1 Answer 1

0

The Authorization header is incorrect, it needs to be Authorization: Bearer <token> . You might want to consider using SF's JS toolkit, it'll make things a lot easier for you at the cost of a small dependency.

You'll also need to think about how CORS works in SF.

6
  • thanks @identigral, but making the Authorization: Bearer <token> doesnt works if i'm in the context of visualforce. But works for a salesforce.com domain! Sep 11, 2019 at 18:33
  • It does work if you obtain the token via oAuth. See Understanding Authentication for more info
    – identigral
    Sep 11, 2019 at 19:22
  • I went through the article. In this case, I'm not making a connection via a connected app so I don't have a refresh token or client_id and so on. I just have the sessionId from the browser cookies which helps for the connection. The problem is only making a connection via Visualforce. I have updated the question, please have a look for details. Sep 12, 2019 at 14:56
  • The issue as you sort of understood by now is that a session id is obtained in a certain context and it gives you certain rights. In many cases a session id is not going to be enough to make a call as you're trying to do, you'll need a connected app et cetera.
    – identigral
    Sep 12, 2019 at 15:18
  • is it possible without a connected app? since I'm making a chrome extension I don't want users to create a connected app for a chrome extension. Sep 12, 2019 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .