I have the following situation :

Dev Org A, with package domain orgA and my domain orgA-dev-ed.my.salesforce.com
Created a package packageA, which contains :
- a static resource : a zip containing a css and related font (linked by relative url - think about SLDS)
- a component orgA:cmpA including this css using ltng:require, and using the font

Dev Org B, with package domain orgB and my domain orgB-dev-ed.my.salesforce.com
Installed packageA.
Created :
- a component orgB:cmpB, which is embedding orgA:cmpA
- a lignthing app orgB:appB embedding orgB:cmpB
- a lignthing app orgB:appBout with aura:dependency orgB:cmpB
- a visualforce page pageB, using Lightning Out to display orgB:cmpB with help of orgB:appBOut

Now I have the following behavior :
- appB is working perfectly well. It is served from https//orgB-dev-ed.lightning.force.com/orgB/appB.app (and the same for all resources)
- pageB is getting the css but NOT the right font.

What is happening behind the scene is :

  1. pageB is served from https//orgB-dev-ed--orgB.eu5.visual.force.com/apex/pageB

  2. css is then asked with RequestUrl https/orgB-dev-ed--orgB.eu5.visual.force.com/resource/orgA__bundle/css, which is redirected to https//orgB-dev-ed--orgA.eu5.visual.force.com/resource/orgA__bundle/css and successfully served

  3. font is asked with RequestUrl https//orgB-dev-ed--orgA.eu5.visual.force.com/resource/orgA__bundle/font , with Origin https//orgB-dev-ed--orgB.eu5.visual.force.com and with Referrer https//orgB-dev-ed--orgA.eu5.visual.force.com/resource/orgA__bundle/css which triggers a CORS issue

Do I miss something or is it a problem with the way Lightning Out is currently working ?

  • 1
    I have the same issue. Did you already found a solution for this?
    – user27155
    Dec 15, 2015 at 14:14

1 Answer 1


So far the way to fix this was to disable the critical update “Serve Static Resources from the Visualforce Domain”.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .