Access the force.com REST API with a pure Javascript page

Question

I want to develop a front-end in Javascript (possibly with one of the fancy frameworks around such as AngularJS) that consumes the REST API of my Salesforce org.

I don't want to embed my project in Salesforce technologies, so basically

• no Visualforce pages
• no Force.com Sites

I do want to write my own front-end on a separate server that just makes AJAX calls to the Salesforce back-end.

In addition, I want the application to be accessible for any user, even if he/she does not have a Salesforce account. So the AJAX calls should not require that the user logs in on Salesforce. I want anonymous users to be able to retrieve public data from my organization and create new entries when it is useful (in the case of a survey for instance).

Even though these requirements generate some security concerns, I can imagine that Salesforce takes care about the requests rate limits on their API endpoints and that it is possible to restrict the access to the API on a host name base (e.g., only requests with origin host my-trusted-domain.com should be allowed, send a 403-Forbidden otherwise). I would be surprised if SF does not provide such basic features.

How would you proceed? Is there a minimal Javascript code that works out-of-the-box on any domain without getting into troubles with CORS?

Answer 1

From the Spring '15 release (coming soon), you will be able to use (most of) the Force.com REST API from JavaScript served from outside Salesforce. Spring ’15 Preview – CORS for the Force.com REST API shows how to upload to Chatter Files, for example.

As that article mentions, there are a few areas that are not currently accessible:

1. Apex REST Methods (/services/apexrest endpoints) - your own web services running on Force.com
2. Describe Global (/sobjects API endpoint) - a listing of your org's objects and their metadata
3. Query (/query API endpoint) - the ability to run a SOQL query via API

2 and 3 were a known issue, but were resolved before the Spring '15 release.

If you need Apex REST Methods, you'll need to run a proxy. The Force.com JavaScript REST Toolkit facilitates this, as described in Calling the REST API from JavaScript… from Anywhere!

Answer 2

Every transaction in Salesforce is based on User context. For this reason, no matter how you approach it, you will always need an Authenticated user to perform an action. There are a couple of exceptions:

1. Email-to-Case/Web-to-Lead - for each of these, data is originating from an unauthenticated form or email. Within Salesforce you must identify a user for each of these transactions to run as.
2. Force.com Sites - every unauthenticated transaction runs as a guest user.

So in order for you to achieve what you want to do, you must identify a user for every transaction OR you exploit the above two examples to achieve what you want to do.

Basically what I am saying is that what you want to achieve is impossible. Salesforce makes it impossible because they make money off the number of users you have. The moment you build an application without a User context, they are giving away their shared architecture for free.