We added the header Access-Control-Allow-Credentials to true

Question

We load JS code by creating a script tag with dynamic src endpoint and append the script element into the page our src will call resource apex class (@RestResource) I know that Community domain is different than the Apex Domain for that we need to add the Domain as Trust site and CORS
Endpoint:

@HttpGet
    global static void getResource(){
        RestRequest req = RestContext.request;        
        RestResponse res = Restcontext.response;

            res.addHeader('Access-Control-Allow Origin',req.headers.get('Origin'));
            res.addHeader('Access-Control-Allow-Credentials','true');

        string responseStr='';
        String hostedFormId= req.requestURI.substring(req.requestURI.lastIndexOf('/')+1);        
        res.addHeader('Content-Type','application/javascript');
        responseStr+=getCustomScript(hostedFormId);
        responseStr+=getRuleScript(hostedFormId);
        responseStr+='\r Console.log("Load from rest api");';
        res.responseBody=Blob.valueOf(responseStr);
    }

Javascript:

var jsLink = document.createElement('script');
jsLink.type = 'text/javascript';
jsLink.src = "https://XXXX.na174.force.com/services/apexrest/FFNResource/v1/34OLM";
jsLink.crossorigin = "";
var parentElem  = document.getElementById('loadJS');
parentElem.appendChild(jsLink);

After Saleforce release we started to get an error

Access to XMLHttpRequest at 'https://XXXXXX/services/apexrest/FFNResource/v1/34OLM' 
from origin 'https://XXXX-developer-edition--live.XXX.force.com' has been blocked by CORS policy: 
The value of the 'Access-Control-Allow-Credentials' header in the response is 'false' which must be 'true' 
when the request's credentials mode is 'include'. The credentials mode of requests 
initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

We added the header Access-Control-Allow-Credentials to true but that did not work we tried to added the script using ajex with dataType = 'Script' but that did not work it show the same error message

Community security setting: Security Level: Relaxed CSP Lightning Locker: ON Trusted Sites for Scripts: 1.https://XXX.force.com 2.https://live.XXX.force.com

I’m able to get 200 response request but not able to load JS into page after make a Request using Ajax with Text date type and withCredentials false

When we are calling https://XXX.force.com from https://live.XXX.force.com using Script dataType we get the Error but we change the dataType to 'text' we get 200 response

enter code here

The flow we are trying to accomplish is to load a dynamic JS script from a reset resource endpoint into Lightning Aura Component page

Q: Can we load a string script or load a dynamic script from Rest resource into a Lightning page?

Did you face this issue before please help!!

Answer 1

Before a CORS call happens, there is a "preflight request". This happens automatically before a resource is accessed for the first time, using a special HTTP verb called "OPTIONS". If this preflight request does not meet certain validations, such as Access-Control-Allow-Credentials, then the call is rejected. It's important to note that this preflight request is fully processed by the Salesforce runtime without calling your Apex Code, so you cannot alter those headers in any way, aside from the Setup configuration settings affecting CORS.

If you want to call an Apex REST method, you can do so without authentication by adding the class to the Public Site Settings. You will call it using the community prefix, such as /communityPrefix/services/apexrest/urlMapping. You can read more about this technique in Quick Tip – Public RESTful Web Services on Force.com Sites.

However, dynamically loading scripts via creating a script is bound to cause problems in Lightning; scripts loaded this way should not work (if they do, it's a bug that will likely be fixed later). You should be using static resources directly, using the officially sanctioned methods for loading scripts; you can load a script with ltng:require (Aura) or loadScript (LWC). There's no need to create an Apex proxy for this.