0

I want to call Salesforce REST APIs (to the same salesforce org where lightning component is built) from client side JS code in Aura/LWC. I have done some research and thought of this approach.

  1. Add Salesforce org URL to the CSP trusted settings and CORS.
  2. get api enabled session Id from apex using one of this approach
  1. pass the api enabled session id using aura enabled apex method to LWC/Aura JS code.
  2. Use the session id received in step 2 to call Salesforce APIs.

I am not sure if this approach will work or will I get CSP or CORS error even though I have added the salesforce org url to the CORS settings.

Security concerns?

This lightning component will only be used by internal employees. I think the security concern of the session id being passed from apex to client side JS code being visible in browser tools shouldn't concern us. Do you think otherwise or does it pose an other security concerns?

Use case:

The user selects more 1 or more files and add details related to each file. The lightning component then validates the details entered for each file by calling apex controller. it displays the validation result and then gives option to proceed with upload of these files and related details.

I can not use lightning-file-upload component (2GB file size) because it will upload the file as soon as user selects it.

If i use input type = file element it is limited with file size of approx 4 MB. So, I came up with this approach to call rest api to upload files after validation without calling apex.

5
  • 1
    what action are you trying to perform that requires this approach? – glls Jan 25 at 13:37
  • The user selects more 1 or more files and add details related to each file. The lightning component then validates the details entered for each file by calling apex controller. it displays the validation result and then gives option to proceed with upload of these files and related details.I can not use lightning-file-upload component (2GB file size) because it will upload the file as soon as user selects it. If i use input type = file element it is limited with file size of approx 4 MB. So, I came up with this approach to call rest api to upload files after validation without calling apex. – Maninder Singh Jan 25 at 15:02
  • please update your post to include this information - also, you might find on this site other users that have asked the same.or similar questions and check out the approach they have taken – glls Jan 25 at 15:36
  • Last I tried calling the sfdc rest api I was not able to do a post while get requests still worked with rest api. I had a similar use case for this, here's my answer to this question : salesforce.stackexchange.com/questions/281357/… – Prashant Kashyap Jan 26 at 4:04
  • I was able to call standard salesforce REST Apis directly from LWC js code bypassing the apex call. I will update the code details for others. – Maninder Singh Feb 4 at 16:33
1

I was able to solve this problem by using the uiRecordApi. The documentation around using this can be found here. Salesforce confirmed passing the session id generated from a VF page to your LWC component is a safety risk.

4
  • Did you create a contentVersion record using uiRecordApi? what is the max size of the file you can upload with this? – Maninder Singh Mar 31 at 17:15
  • Yes, I created a ContentVersion record using uiRecordApi. I am still validating this but the max size should be the same as the REST API of around 40mb. I will post once I verify this or please let me know if you verify as well. – Philip Jones Apr 2 at 17:00
  • Looks like uiRecordApi createRecord also has a limit around 4MB salesforce.stackexchange.com/questions/329144/… @ManinderSingh were you able to solve this? Can you share your solution? – Philip Jones Apr 5 at 20:25
  • yes, i solved it but with the approach of getting the API enabled session ID from VF page which is passed to LWC. From LWC I call Salesforce composite API for bulk upload of files selected by the user. – Maninder Singh Apr 6 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.