Http CORS violation from Customer Digital Experience

Question

As a dutiful admin, I followed up on the email SFDC sent me entitled Reminder: Get Ready to Enforce the CORS Allowlist for Lightning Apps as my PROD org was mentioned as affected

You’re being contacted about this change because your org has one or more external domains calling on your Salesforce resources that are affected by this change. Read on for more information about the change and how to prepare today to avoid impact before the Spring ‘22 release.

I ran the handy Salesforce Event Log File Browser tool and got back three entries in the last 30 days. One of them looked like:

EVENT_TYPE        CorsViolation
TIMESTAMP         20211107043740.10
REQUEST_ID        4fJdf5XhvZZB7ykCagbVi- 
ORGANIZATION_ID   00D36xxxxxxxxxx
ORIGIN            http://support.mycompany.com
HOST              support.mycompany.com:443
TIMESTAMP_DERIVED 2021-11-07T04:37:40.155Z

support.mycompany.com is our Digital Experience (neé Community) for guest user support

At first blush, It looked like I needed to add http://support.mycompany.com to my CORS allow list in Security Settings. But you can't add http entries to the CORS allowlist.

What to do?

Answer 1

The CORS violation entry ORIGIN http://support.mycompany.com is stating that a request from this http page attempted to access port 443 of support.mycompany.com; i.e. make an https request.

How could this happen?

Well, turns out one of 100+ Knowledge articles had a hyperlink to http://support.mycompany.com/someArticleId. Every other Knowledge Article, used https://... where hyperlinks to other Knowledge Articles were relevant.

Some guest user had clicked the hyperlink and, as SFDC attempted to redirect to https, a CORS violation occurred.

Fixing the Knowledge Article resolved the issue.