From my Visualforce page I am calling an externally hosted Javascript app:

    <apex:iframe src="https://external.com/index.html" id="theFrame" />

This external JS is trying to pull data from a Visualforce page located at:


I added the external domain to my orgs CORS settings

enter image description here

The issue is the external script doesn't see the page and gets errors:

Refused to connect to 'https://java-business-5237-dev-ed.cs69.my.salesforce.com/visualforce/session?url=https%3A%2F%2Fjava-business-5237-dev-ed--c.visualforce.com%2Fapex%dataPage' because it violates the following Content Security Policy directive: "connect-src 'self' https://api.bluetail.salesforce.com https://staging.bluetail.salesforce.com https://preprod.bluetail.salesforce.com blob: *.visualforce.com https://java-business-5237-dev-ed--c.documentforce.com https://cs69.salesforce.com".


2 Answers 2


You cannot access a Visualforce page from an external site unless you create a Salesforce site and access it.

See this answer for details: Visual Force Page which can be accessed by anyone


It seems, you need to add few of the domains in the whitelisted settings.

As per this Allow the Required Domains :

If you control your users’ or servers’ access to the Internet through allowlists, add these domains to ensure that you receive all Salesforce content.

  • *.bluetail.salesforce.com
  • *.content.force.com
  • *.documentforce.com
  • *.force.com
  • *.forcesslreports.com
  • *.forceusercontent.com
  • *.lightning.com
  • *.salesforce.com
  • *.salesforceliveagent.com (used with Chat, Omni-Channel, and SOS)
  • *.salesforce-communities.com (necessary if you’e using Communities or Site.com) trailblazer.me
  • *.visualforce.com
  • Do I need to add them to CORS? Should I remove what’s already there? I’m confused as I expected the cors setting to be for the external site. Sep 9, 2020 at 18:12
  • 2
    You need to add on top of that. I think req is traveling through different server internally to Salesforce.
    – Ysr Shk
    Sep 9, 2020 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.