Hot answers tagged

6

Updated: As of the Summer '16 release CORS is available for Apex REST Classes. This is described in Use CORS to Access Salesforce Resources from Web Browsers. These Salesforce technologies support CORS. Analytics REST API Bulk API Chatter REST API Salesforce IoT REST API Lightning Out REST API User Interface API Apex ...


5

Ok. I did some research on this and looks like we both interpreted the Salesforce CORS documentation wrongly. Salesforce CORS says that CORS is only for making requests to Supported Salesforce APIs, Apex REST, and Lightning Out but not for making calls to Salesforce pages(as you are trying to do) because that is not exposed an API. I created a simple ...


4

Looks like Apex REST now supports CORS: http://blog.lkatney.com/2016/05/04/salesforces-summer-16-release-is-here/ Apex REST now supports CORS. To access Apex REST classes from JavaScript in a web browser, add the origin that’s serving the script to the CORS whitelist. To add an origin to the CORS whitelist, from Setup, enter CORS in the Quick Find box, then ...


4

You should make use of callback parameter in the call to recommend.json - you can easily append it if you have existing parameters in your querystring: https://{MID}.recs.igodigital.com/a/v2/{MID}>/category/recommend.json?category={CATEGORY}&item={CONTENT_ID}&callback=foobar This will wrap the response in a function call with the name passed in ...


3

It seems, you need to add few of the domains in the whitelisted settings. As per this Allow the Required Domains : If you control your users’ or servers’ access to the Internet through allowlists, add these domains to ensure that you receive all Salesforce content. *.bluetail.salesforce.com *.content.force.com *.documentforce.com *.force.com *....


3

This is a restriction not related to Lighting CORS; all browsers block this sort of behavior to protect against various security exploits. Instead, call a server action and retrieve the file in Apex, then process the results client-side. Example: Controller doInit: function(c, e, h) { var a = component.get("c.getImage"); a.setParams({ attachmentId: "...


3

You need to redirect the browser to the login server. The process won't work with XMLHttpRequest/JavaScript, even if there was CORS, because it is inherently a browser-based flow. The correct order of operations for the OAuth2 Web Server flow is: redirect to Salesforce, user logs in and grants access, as necessary, Salesforce redirects back to your server, ...


3

the issue can be addressed using the built-in HTTP(S) Proxy. You can enable the proxy in the standard setup menu: Setup -> Security Control -> Remote Sites / Remote Proxy Settings Salesforce Setup Menu There you can add your own salesforce instance. e.g. eu1.salesforce.com (don't forget to enable https) In a second step you have to modify your ajax ...


2

Salesforce has been increasingly locking down the ability to modify standard pages via JavaScript and CSS hacks, because it interferes with their future plans for enhanced user interfaces (for example, see the Lightning Experience feature that was just released). By disallowing sidebar hacks, they've made sure that you can only write code that will be ...


2

Looks like there's no workround for the CORS issue, so solution is to solve it by using HTML "form" and "action" to refresh parent page, as per this article. https://www.xgeek.net/en/salesforce/refresh-standard-detail-page-from-visualforce-page-in-iframe/


2

It appears that $resource is not correctly absolutizing URLs like it is supposed to - known bug tracking this is W-3633321. This issue is not specific to Locker however. There is another issue recently identified in the newly introduced work to support removal of CSP unsafe-inline/eval that is related in that it's another relative versus absolute URL ...


2

It's not intuitive but the expected way to embed lightning components for guest users is with a public access community rather than a force.com site directly. I believe you can make it work with a force.com site but if you have communities enabled in the org that is the better supported approach. Steps Create and activate a "SF Tabs and VF" community Add ...


2

So as per your updated question and requirement of lightning component to view/load/download any kind of file in browser then you should get respective Content Version of the file you wish to view/download and form a URL. If it is coming from an sobject record then get the contentDocumentId from the contentDocumentLink record whose linkedEntityId will be ...


2

Usually when you try to access any file form Files tab you will access the ContentDocument ID with URL something like this https://sample-dev-ed.lightning.force.com/lightning/r/ContentDocument/0696F000009AAAAAAA/view You will only use the above url you specified can be modified with content version id so that when you want to preview a file which is ...


2

If additional script resources are necessary, they will be denied because of Lightning's very restrictive CSP. You cannot fix this. As an alternative, consider using D3js, which can run without any external assistance, or find another alternative that can run without outside scripts.


1

You cannot access a Visualforce page from an external site unless you create a Salesforce site and access it. See this answer for details: Visual Force Page which can be accessed by anyone


1

To Summerize what fixed this issue for us: We added the Integration User to the Site (Community). Selected the Orgwide session setting - Setup > Security > Session Settings - "Activate the Lock sessions to the IP address from which they originated"


1

Answer is pretty simple and it was so stupid of me. I can't white list localhost. I simply deployed this to Heroku and white listed the Heroku URL and bang. It worked like charm.


1

You should never invoke this or any similar API from the frontend / client side. If you do so your credentials (client id and secret) are exposed to everyone. A user can therefore attack (depending on the scope of your installed package) your marketing cloud instance massively! If there is just an isolated function you need to perform in your instance, you ...


1

Cross-Origin Resource Sharing (CORS) enables web browsers to request resources from origins other than their own (cross-origin). For example, using CORS, JavaScript code at https://www.example.com could request a resource from https://www.salesforce.com. To access supported Salesforce APIs, Apex REST resources, and Lightning Out from JavaScript code in a web ...


1

You need to whitelist your own visualforce page with the request you're trying to perform. Try going to Setup -> CORS and add https://*.visual.force.com as a whitelisted origin


1

I initially had missunderstood your question, sry. Is it possible to bypass security policies - If yes, that means there would be a flaw or bug in the architecture. So, no, it is not possible. In Lightning, your static resource has to be Locker service compliant, in visualforce, you have to meet the security requirements imposed in your salesforce org (...


1

You did all the right configuration on the app side but you missed one on the Salesforce side. You need to register the app domain under Setup: Administer > Security Controls > CORS This should work. It is actually documented fairly well as part of the new force.js release. (*) Starting in the Spring 15 release, some Salesforce REST APIs (like ...


1

The error that you are experiencing is related to CORS headers. However, I'm deeply concerned that you are attempting to use a client-side JavaScript to make a REST API request to Marketing Cloud, as the OAuth credentials are easily accessible to anyone accessing website. You should always keep these credential secret and ensure that they are never made ...


1

This error is occurring because of cross domain. Salesforce hosts VF pages at c.{domain}.salesforce.com and SF Resources are hosted at {domain}.salesforce.com All current browsers does not allow cross domain referencing, without explicitly declaring "Access-Control-Allow-Origin" header in your API call. if you are using Ajax to submit the call, set ...


1

This is blocked by the browser because of the Same Origin Security Policy. The embedded VF page in the iframe cannot interact with its parent page because it is served from a different domain than a standard page. https://*.salesforce.com vs https://*.visual.force.com You will need to find another way to accomplish your goal. You might need to resort to ...


1

As of Summer 16, Apex REST now supports CORS: https://releasenotes.docs.salesforce.com/en-us/summer16/release-notes/rn_apex_rest_cors.htm


1

It is very possible that localhost is the issue and you can only whitelist domains that are externally hosted. But I have no source to back up my assumption. I seem to recall trying this long before I had even heard of Salesforce and it still being a problem. Something like this question. If you're not using Chrome, then it seems more likely to be a ...


1

From the Spring '15 release (coming soon), you will be able to use (most of) the Force.com REST API from JavaScript served from outside Salesforce. Spring ’15 Preview – CORS for the Force.com REST API shows how to upload to Chatter Files, for example. As that article mentions, there are a few areas that are not currently accessible: Apex REST Methods (/...


1

You will have to channel through the VF proxy to resolve this error https://gist.github.com/henriquez/3146782 https://gist.github.com/richardvanhook/4677449 The above gist should help and I have reproduced the content below so that helps even when link is broken .Replace with necessary URL and should help <apex:page controller="...


Only top voted, non community-wiki answers of a minimum length are eligible