0

I'm a little worried that what I want to do is not supported at all and I'm hoping someone can quickly give me an indication if I'm on the wrong track.

My goal:

  1. Create a client-side only JS app on an external domain
  2. Allow users to login via Embedded Login and External Identity and obtain an access token
  3. Use that access token to query apexrest endpoints to create an end user experience leveraging the Salesforce objects in my org

How far I've gotten: I have everything working to the point where I have an access token and can successfully authenticate against my org and get an Access Token.

What's not working: When I try to access my apexrest endpoints using my successfully aquired access_token, I get a CORS error: Access to XMLHttpRequest at XXXXXXX has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

I understand that when I set nearly any custom header I will end up with a preflight request to determine eligibility and since I'm trying to pass my Authorization as a header the browser is automatically sending a preflight http request without those headers.

When I view the document there I see an INVALID_SESSION_ID error

I'm just using jquery for my prototype so my api request is:

jQuery.ajax({
    type: "GET",
    url: url,
    crossOrigin: true,
    cache :false,
    xhrFields: {
        withCredentials: true
    },
    beforeSend: function(xhr){
       xhr.withCredentials = true;
    },
    headers: {
        "Authorization": "Bearer "+identity.access_token,
        "Content-Type": "application/json"
    }, success: function(event){
        console.log('success '+event);
    },
    error:function(event){
        console.log('error '+event);
    }
});

I have an external app registered for my domain and I have every CORS entry you could imagine for it.

So my question: is it even actually possible to create a completely client-side app on an external domain that leverages external identity to authenticate and use it's access_token in subsequent JS API calls directly to Salesforce or do I have to implement something like a JSforce server side app in addition?

0

I had faced similar type of issue. Although I was doing different activity. This is happening because you have used withCredentials as true, which Salesforce does not support/recommend.

Also, you are passing the token, so you don't need any other cred.

Please try with removed withCredentials block like this -

jQuery.ajax({
    type: "GET",
    url: url,
    crossOrigin: true,
    cache :false,
    headers: {
        "Authorization": "Bearer "+identity.access_token,
        "Content-Type": "application/json"
    }, success: function(event){
        console.log('success '+event);
    },
    error:function(event){
        console.log('error '+event);
    }
});
6
  • Thanks for checking, I've removed that but I'm still encountering the preflight CORS error. Any other thoughts? – Adam Aug 4 '20 at 14:12
  • Same error is coming? Or any update? – Ysr Shk Aug 4 '20 at 14:59
  • Sorry for the delay, I ended up creating a very simple proxy on the same external domain that my external identity login process is hosted. basically now I call a url end point on my external domain which performs a curl request to my salesforce org. Now I'm getting an entirely new problem which is that I get [{"errorCode":"FORBIDDEN","message":"You do not have access to the Apex class named: APIPropertyManager"}]" – Adam Aug 5 '20 at 19:45
  • This is not reqd, you can simply check for the data in your code. So now, curl also needs to pass all creds(token/url) etc. Best way to have direct API and just handle the null/empty check in it. Pls check and optimize the current code only. – Ysr Shk Aug 6 '20 at 1:52
  • 1
    After a lot of playing around I realized that the problem was the callback was returning the access token with the '!' replaced with a URL entity '%21'. I just did a string replace and my access token was working. – Adam Aug 17 '20 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.