So there are now settings to add domains to the CORS whitelist so they can access the REST API via javascript. I tried to get this to work using my localhost with an a local ssl so its https://coach.dev:8443

But im still getting this error:

XMLHttpRequest cannot load https://test.salesforce.com/services/oauth2/token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://coach.dev:8443' is therefore not allowed access.

Any ideas what I might be missing?


Also important to note if i request the token via the proxy, and then remove the proxy from all the other requests it does seem to respect the CORS settings and let me do queries without a proxy.

Is is just that the token request wont use the CORS?


2 Answers 2


It is very possible that localhost is the issue and you can only whitelist domains that are externally hosted. But I have no source to back up my assumption. I seem to recall trying this long before I had even heard of Salesforce and it still being a problem.

Something like this question. If you're not using Chrome, then it seems more likely to be a Salesforce issue.

  • 2
    You can whitelist localhost, but it has to be https (I've filed a request that we allow http for localhost only).
    – metadaddy
    Commented Mar 24, 2015 at 16:23
  • Hey guys, updated the request, had tried with both and coach.dev:8443 adn just mixed up the copy and paste of the error. I cleaned up above. I also added an update where it appears the CORS is working correctly for every request besides the token request. If i use the proxy to get the token then remove it for the query request it works fine? Commented Mar 24, 2015 at 16:35

You need to whitelist https://coach.dev:8443, since that is the URL that the browser is trying to use. Even if coach.dev resolves to, the browser doesn't look at that - it just looks at the host in the URL.

  • I did, sorry should have mentioned that. So an update is that it is working for every request, except the authentication request which gets the token. Is that just not available without a proxy? Commented Mar 24, 2015 at 16:31
  • Correct - authentication endpoints are not available via CORS - see this comment.
    – metadaddy
    Commented Mar 25, 2015 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .