I have a Visualforce web page, version 30, that contains a table of Salesforce data and two iframes. The Salesforce page itself uses the HTTPS protocol. The source of the first iframe is a non-Salesforce page served with the HTTPS protocol. The source of the second iframe is served with the HTTP protocol. This means the page needs to mix both the HTTP and HTTPS protocols which is a browser security violation. In Firefox, the contents of the HTTP iframe never appears and no message is presented to the user. Thus, the page is unusable. In Internet Explorer, the user get a message stating "Only secure content is displayed. What's the risk?". To see the contents of the HTTP iframe the user must click on a button labeled "Show all content", and then click on a second dialog box. The warning about secure content make the page unusable in IE as well. Although in IE one can change their security settings to allow mixed protocols, this is a significant security issue and not a viable alternative.

To bypass this mixed protocol security issue with the use of a proxy server, I attempted to use the remoteFunction method from the Salesforce Ajax Toolkit. The pertinent JavaScript calling this function is shown below. However, calling this function fails with a combination of errors. From the console log I see the "VMT Call Failed: " message with the error:

Error 400 Unable to forward request due to: Read timed out

And from the network traffic log I get a Page Not Found error as follows:

https://test.salesforce.com/javascript/1407490843000/sfdc/source/SessionServer190.js.map. Result: HTTPS GET 404.

What might be the problem here? Is there a syntax error? Did the SessionServer190.js.map file change it's location between different versions of the toolkit? Or between different versions of Salesforce? Or is there some other environmental context that needs to be set up before making the call? The line "//sforce.connection.sessionId = __sfdcSessionId;" makes no difference whether it is commented or not.

<script type="text/javascript">
    // Get sessionId for Ajax Proxy Server
    var __sfdcSessionId = '{!GETSESSIONID()}';
    console.log("Session ID: " + __sfdcSessionId);
<script src="../../soap/ajax/31.0/connection.js" type="text/javascript">

<script type="text/javascript">            
    function submitVMTProxyCall() {
        console.log("Entered submitVMTProxyCall.");
        //sforce.connection.sessionId = __sfdcSessionId;
            url : "http://...(URL obscured)",
            onSuccess : function(response) {
                console.log("VMT Call Succeeded " + response);
            onFailure : function(response) {
                console.log("VMT Call Failed: " + response);

1 Answer 1


External calls must be done via APEX for security reasons.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .