What is the difference to do a callout from Client side controller and Server side controller.

Thanks Janakiraman

  • Too many differences, both have there own use cases, what is your use case? Dec 21, 2020 at 13:22

1 Answer 1


The four main differences are CORS, security, governor limits, and intranet (not Internet) access.

A client-side script has limitations placed on it by the the browser, so if the server doesn't allow CORS, it won't work. In addition, if you need a private key, you're effectively letting the client have this key in order to make the call work. This can be a security concern.

The upside is that you have unlimited timeout and bandwidth usage, even hundreds of megabytes if you need it. Server-side calls do not have to worry about CORS, so are technically easier to use, but are limited by the 6MB heap and the 120 second timeout restrictions of Apex.

Client-side scripts can also access intranet resources that Salesforce cannot. While this requires some extra configuration, it's a great way to provide access to data locally without exposing it to the Internet.

Use client-side for better performance and capabilities whenever possible, and use server-side if CORS is an issue or there are particular security concerns, such as leaking a private key or private certificate. While implementing this in Salesforce is relatively secure, as only users who can log in to your org can use the code, this isn't 100% secure, as people can make mistakes like not locking their device while they step away for a break.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .