1

So there are now settings to add domains to the CORS whitelist so they can access the REST API via javascript. I tried to get this to work using my localhost with an a local ssl so its https://coach.dev:8443

But im still getting this error:

XMLHttpRequest cannot load https://test.salesforce.com/services/oauth2/token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://coach.dev:8443' is therefore not allowed access.

Any ideas what I might be missing?

UPDATE:

Also important to note if i request the token via the proxy, and then remove the proxy from all the other requests it does seem to respect the CORS settings and let me do queries without a proxy.

Is is just that the token request wont use the CORS?

|improve this question
1

It is very possible that localhost is the issue and you can only whitelist domains that are externally hosted. But I have no source to back up my assumption. I seem to recall trying this long before I had even heard of Salesforce and it still being a problem.

Something like this question. If you're not using Chrome, then it seems more likely to be a Salesforce issue.

|improve this answer
  • You can whitelist localhost, but it has to be https (I've filed a request that we allow http for localhost only). – metadaddy Mar 24 '15 at 16:23
  • Hey guys, updated the request, had tried with both 127.0.0.1:8443 and coach.dev:8443 adn just mixed up the copy and paste of the error. I cleaned up above. I also added an update where it appears the CORS is working correctly for every request besides the token request. If i use the proxy to get the token then remove it for the query request it works fine? – Keith Mancuso Mar 24 '15 at 16:35
0

You need to whitelist https://coach.dev:8443, since that is the URL that the browser is trying to use. Even if coach.dev resolves to 127.0.0.1, the browser doesn't look at that - it just looks at the host in the URL.

|improve this answer
  • I did, sorry should have mentioned that. So an update is that it is working for every request, except the authentication request which gets the token. Is that just not available without a proxy? – Keith Mancuso Mar 24 '15 at 16:31
  • Correct - authentication endpoints are not available via CORS - see this comment. – metadaddy Mar 25 '15 at 0:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.