4

From my Visualforce page I am calling an externally hosted Javascript app:

<apex:page>
    <apex:iframe src="https://external.com/index.html" id="theFrame" />
</apex:page>

This external JS is trying to pull data from a Visualforce page located at:

fetch("https://mydomain.visualforce.com/apex/dataPage").then(...);

I added the external domain to my orgs CORS settings

enter image description here

The issue is the external script doesn't see the page and gets errors:

Refused to connect to 'https://java-business-5237-dev-ed.cs69.my.salesforce.com/visualforce/session?url=https%3A%2F%2Fjava-business-5237-dev-ed--c.visualforce.com%2Fapex%dataPage' because it violates the following Content Security Policy directive: "connect-src 'self' https://api.bluetail.salesforce.com https://staging.bluetail.salesforce.com https://preprod.bluetail.salesforce.com blob: *.visualforce.com https://java-business-5237-dev-ed--c.documentforce.com https://cs69.salesforce.com".

Improve this question
0

2 Answers 2

Reset to default
1

You cannot access a Visualforce page from an external site unless you create a Salesforce site and access it.

See this answer for details: Visual Force Page which can be accessed by anyone

Improve this answer
3

It seems, you need to add few of the domains in the whitelisted settings.

As per this Allow the Required Domains :

If you control your users’ or servers’ access to the Internet through allowlists, add these domains to ensure that you receive all Salesforce content.

  • *.bluetail.salesforce.com
  • *.content.force.com
  • *.documentforce.com
  • *.force.com
  • *.forcesslreports.com
  • *.forceusercontent.com
  • *.lightning.com
  • *.salesforce.com
  • *.salesforceliveagent.com (used with Chat, Omni-Channel, and SOS)
  • *.salesforce-communities.com (necessary if you’e using Communities or Site.com) trailblazer.me
  • *.visualforce.com
Improve this answer
2
  • Do I need to add them to CORS? Should I remove what’s already there? I’m confused as I expected the cors setting to be for the external site.
    – Robert Sösemann
    Commented Sep 9, 2020 at 18:12
  • 2
    You need to add on top of that. I think req is traveling through different server internally to Salesforce.
    – Ysr Shk
    Commented Sep 9, 2020 at 18:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .