It is difficult to know exactly what is wrong without some code, but I will take a stab based on a couple of assumptions:
- You are making a classic XHR call either directly, or via
- You are requesting some Salesforce endpoint...most likely the Salesforce REST API endpoints found at
https://XXXX.salesforce.com/services/data/v34.0 or perhaps your own Apex REST endpoint
A bit of history: Visualforce, the predecessor to Lightning Components, always ran in an iFrame when embedded in the standard UI (for instance an inline VF page in a page layout). This was a security measure to reduce the certain malicious attacks due to the VF page being compromised.
But this tied the hands of VF from being able to be a full-fledged member of the UI, making it difficult to use VF for small behavior changes (like modifying a single field on a page layout).
In comes Lightning Components. One of the promises (currently in pilot as Lightning Extensions) is for us to be able to do exactly these kind of very granular customizations. In order to do this Lightning Components could not be in an iFrame.
But to have unknown code sharing the UI with our code is a potential security risk.
To mitigate this security risk, Salesforce has put in place strict content security policy (aka CSP) for Lightning Components.
If you take a look at the
Content-Security-Policy header for your lightning app you will see that the policy rule for XHR requests (
connect-src) is set to
This means that any XHR would only be allowed by the browser to make requests to endpoints of the exact same domain as your Lightning App. For my org, I have a Lightning app running at this URL:
This means an XHR would only be allowed to endpoints that are in the domain
eu5.lightning.force.com. No other endpoints would work. Not even other valid Salesforce endpoints like
In fact, the request won't even make it to the server. The minute you invoke the
send method on your XHR, CSP will object very strongly. Here is a quick example using the browser console, attempting to put together an XHR to go to
The long and the short of it is that the only way to connect to your Salesforce data today from LCF is an Apex method surfaced using
@AuraEnabled that is invoked using the ActionService by creating an action instance and passing it to
Since the launch of LCF, the product team have spoken of implementing a way to whitelist additional endpoints in the future. CSP allows for exactly this functionality. But now we fall into the realm of forward looking statements, as this feature does not exist yet. And there are more than just technological obstacles: the Salesforce security and trust team would need to determine that a whitelist feature would not lead to additional security risks.
This may have been a lot of work if my assumptions above were wrong...but hopefully educational nevertheless.