I developed Visualforce page and I want to redirect to external website using apex:actionFunction, every time I execute actionFuncton I got the following error

Access to XMLHttpRequest at 'https://icom.yaad.net/' (redirected from 'https://my-dev--new--c.cs102.visual.force.com/apex/IdentificationBeforeRegistrationPage') from origin 'https://my-dev--new--c.cs102.visual.force.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I tried to add https://icom.yaad.net/ this website to CORS settings under setup, but it doesn't work, any idea how I can solve the issue?


code snippet:

<apex:actionFunction action="{!redirectToPaymentPage}" name="moveToPaymentPage" reRender="none">

        <apex:outputText rendered="{!forceRedirect}">
            <script type="text/javascript">
                window.onload = function() {
 url = 'https://icom.yaad.net/p?firstName=test';
        PageReference target = new PageReference(url);
        // This is a permanent redirection
        return target;
  • We'd have to see enough code to reproduce the issue. It sounds to me like you're actually just calling the server in JavaScript instead of redirecting.
    – sfdcfox
    Mar 12, 2021 at 23:41
  • @sfdfox I updated the code in the description. Mar 13, 2021 at 7:42

1 Answer 1


You should never directly overwrite window.onload in a Visualforce page, as this can cause bad things to happen. If you wish to keep the code as is, use a proper event handler:

window.addEventListener('load', function(event) {

This allows the Visualforce page to properly initialize in the browser.

However, this is a JavaScript-based redirect, which can cause problems. I'd avoid doing this on purpose.

If you want to redirect on page load, you can do so directly from the page's action method:

<apex:page action="{!redirectIfNecessary}" ...


public PageReference redirectIfNecessary() {
  if(forceRedirect) {
    return new PageReference('https://icom.yaad.net/p?firstName=test');
  return null;

Note that you should not use 301 "Moved Permanently" unless you want people to never be able to use your page, as browsers may remember this decision and make it "impossible" to navigate back to the page. I'd advise using 307 if you meant to replay the request, including the original verb, at the new URL, or 303 if you want it to be a GET instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .