1

Im trying call one endpoint from marketing cloud rest api with AJAX, but im having problems with CORS.

This is the error: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Pls help-me.

Improve this question
2
  • 2
    You should not use your REST API directly from AJAX, as it exposes your client ID and Secret. I will advise you to create a JSON Code Resource in Cloud Pages. You will be able to call this instead, and let it read/write the data for you.
    – Lukas Lunow
    Commented Nov 27, 2019 at 19:06
  • 2
    I second what @LukasLunow says. That being said, are you aiming it to one of the SFMC REST endpoints, or to a cloudpage you built? The 'Access-Control-Allow-Origin' is set at the target page, so if its a page you control, you can add (salesforce.stackexchange.com/questions/137172/…) but if its an SFMC endpoint, I think you are out of luck and should explore another option.
    – Gortonington
    Commented Nov 27, 2019 at 19:15

1 Answer 1

Reset to default
2

You should never invoke this or any similar API from the frontend / client side. If you do so your credentials (client id and secret) are exposed to everyone. A user can therefore attack (depending on the scope of your installed package) your marketing cloud instance massively!

If there is just an isolated function you need to perform in your instance, you could do this directly from a processing page you create using CloudPages and access the functionality via SSJS or AMPscript (even using native functions or the API).

However, also for this approach you should verify the input payload and only perform the action if it is/seems legitimate.

If you need more information or have questions regarding information security I suggest checking the Open Web Application Security Project's guidelines, as well as checking out Information Security Stack Exchange:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .