I thought not, until I saw this post How do I open up a public REST API to JavaScript in any website? (and tweet https://twitter.com/metadaddy/status/453026655892545536) by Pat.

Pardon my denseness but wouldn't that require access to something like an @HttpOptions annotation in custom APEX REST, in order to reply to the preflight CORS check?

Otherwise I guess my option is this little solution http://www.jamesward.com/2014/06/23/cross-origin-resource-sharing-cors-for-salesforce-com


Any apex class can be exposed by using Site in Salesforce from the Site User Profile. In that if Apex class has `url mapping' then you can access that class from a public site created in Salesforce.

like: https://restservice-developer-edition.eu2.force.com/services/apexrest/ifnamespace/accounts/0/contact?params=value

For the answer of using @HttpGet like annotations, You still require to specify the request method to be processed in an Apex rest class.

If a GET request is made, @httpGet annoted method will be invoked and there RestContext is available where you can get all request variables.

So similarly CORS can be added there using RestContext


RestResponse res = RestContext.response;
res.addHeader('Access-Control-Allow-Origin', 'http://mydomain.force.com');
res.addHeader('Content-Type', 'application/json');
  • Thanks for taking the time to respond. I currently have this service exposed on a site, and if I use a browser extension (Chrome Rest Console) to pass data to it, it behaves correctly when calling the Http Post method. So you are saying that i should just add the above code (with the domain name or a wildcard) to the HttpPost Method and it will work? Will try. – AJ D Aug 1 '14 at 15:22
  • here's what i have for now @HttpPost global static String submitSurvey(){ RestResponse res = RestContext.response; res.addHeader('Access-Control-Allow-Origin', '*'); res.addHeader('Content-Type', 'application/json'); result: XMLHttpRequest cannot load orientatio-cfa.cs8.force.com/portal/services/apexrest/…. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'elearninginnovation.com' is therefore not allowed access. story.html?sfid=003L000000NIZPz&contextid=a0cL00000046IgR&resourceid=a0SL0000002df0r – AJ D Aug 1 '14 at 15:46
  • I think i figured it out - the request is sending non form or text data (json) so it's preflighting, hence its not hitting the HttpPost but Options. I'll try to modify the sending info and see if this all works. – AJ D Aug 1 '14 at 18:39
  • 5
    Turns out I was able to make this work. We kept the inbound calls meeting the W3C spec for "simple" CORS which avoided preflight. We then parse the origin against a set of known good domains and echo it back if it matches one of them. We pass unique key values determined by additional request parameters as an added measure of security (for now). All in all, nice option for what I thought was a dead end! – AJ D Aug 12 '14 at 17:27
  • 2
    @AJD - any chance you could edit regal's answer a little, then accept it to show that you got it working? – metadaddy Oct 6 '14 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.