This article describes how to deal with a CORS error when a flow using Office File Creator is executed from the list view and does not proceed from the middle of the process with a CORS error.
Error Cases
A CORS error will occur if all of the following conditions 1 to 4.
- Lightning Web security is disabled.
- A managed package loads static resources in LWC (Lightning Web Components)
- Used in a flow
- List View or "Run" Button on Flow Builder. (No error occurs in "Debug" button)
How to check Lightning Web Security is enabled/disabled
From Setup > Session Settings, check enable/disable "Use Lightning Web Security for Lightning web components and Aura components".
Static Resource Usage in Office File Creator
Office File Creator loads static resources (javascript library) and decompresses and compresses ZIP files when the output file type is Excel, Word, or PowerPoint. The Office file entity is a ZIP file of multiple XML files. When PDF output, the static resource is not loaded, so no error occurs.
How to check for CORS errors
Open the console screen of your browser. In the case of Chrome, press F12 on the keyboard to display the console screen. If the console screen displays "Access to XMLHttpRequest at...", a CORS error has occurred.
Solution and Alternative
Solution
As a solution to the error, enable Lightning Web Security. There are some notes on activation.
- Before enabling Lightning Web Security in the production organization, it is necessary to confirm in the Sandbox that programs and managed packages in the organization are not affected.
- When enabling or disabling Lightning Web Security, the browser cache must be cleared and the user must be logged out.
*About enabling Lightning Web Security, ask your organization's system administrator or Salesforce help.
Reference
Enablement of Lightning Web Security Begins
Secure Your Components Better, Stronger, Faster with Lightning Web Security (Generally Available)
Alternative
For organizations that cannot enable Lightning Web Security, an alternative is to run the flow with the data table on the application page. To select records, use the data table instead of the list view. No errors will occur on the application page.
Flow Overview
- Retrieve records of the target object
- Set the records to a data table (instead of a list view)
- Execute OFC
- Place the flow on the application page
For the details, refer to the following.
Create documents of selected records in the data table of a Flow in Salesforce
*For errors with the "Run" button in the Flow Builder, use the "Debug" button instead of the "Run" button.
(Reference) Error Considerations
A CORS error is an error that occurs when accessing to an external domain URL. Because a namespace is assigned to the domain URL of the static resource in the managed package, the URL is considered to be different from the original domain and a CORS error occurs.
However, since the domain URL of the static resource in the managed package is assigned a namespace and can be accessed from the settings screen, it seems that the error occurs under certain screens.
Original Domain URL
https://mydomain--demo--c.sandbox.vf.force.com/resource/1719825364000/ofc2__OFC_Zip/jszip.min.js
Access to URL
https://mydomain--demo--ofc2.sandbox.vf.force.com/resource/1719825364000/ofc2__OFC_Zip/jszip.min.js
Error Message
Access to XMLHttpRequest at "xxxxx"
from origin 'xxxxx' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Static Resource URL
From Setup>Static Resources, the "View file" link has a namespace in the domain URL. Normally, when accessing resources in managed packages, the namespace + __ + resource name is used to access the resource, and no namespace is assigned to the domain URL. It seems odd that the namespace is assigned to the domain URL, but the static resource can be downloaded by clicking the "View File" link.
LWC Code
Office File Creator's LWC reads static resources in the usual Salesforce way. Namespaces are automatically assigned to all resources when the administrative package is created. It does not appear to be a problem with the LWC code, as the error occurs under specific conditions.
//Import a static resource
import { loadScript } from 'lightning/platformResourceLoader';
import JSZIP_JS from '@salesforce/resourceUrl/OFC_Zip';
//Load a static resource
loadScript(this, JSZIP_JS + '/jszip.min.js')
CORS Settings
I tried registering on the CORS permission list, but the error was not resolved.
Setup > CORS > Allowed Origins List
https://mydomain--demo--c.sandbox.vf.force.com
https://mydomain--demo--ofc2.sandbox.vf.force.com
(Reference) Similar Cases
There was a similar case with an error in the past. This was an Aura component + static resource (managed package), where a CORS error occurred when applying a certain release update for Winter 21.
Winter 21
Enable Secure Static Resources for Lightning Components (Update, Postponed)
Kown issues
Summer 22
Enable Secure Static Resources for Lightning Components (Update, Postponed)
(Reference) About Enabling Lightning Web Security
The following is an example of the impact on LWC development when switching from disabling to enabling Lightning Web Security.
Error when using Aura function in LWC
When using Aura Component event $A.get with eval in LWC, an error occurred when Lightning Web Security was enabled. The following is code to update the display of a component on the records screen. Upon execution, the error message “$A is not defined” will be displayed.
eval("$A.get('e.force:refreshView').fire();");
This error was resolved with the release of LWC's RefreshEvent feature, which replaced the code.
RefreshEvent
//Import RefreshEvent
import { RefreshEvent } from 'lightning/refresh'
//Refresh the components on the screen.
this.dispatchEvent(new RefreshEvent());
Significantly slower in LWC's massive looping process
If the LWC has a large loop of data, it will take significantly longer to process.
Reference
LWCs cause 10-20 seconds of lag populating a small amount of elements on the page
(Reference: StackExchange)
In Office File Creator, the processing time for normal file output is not much different from the time of deactivation, but when outputting images of record values (OFC Pro feature), if the total image size is 5 MB or larger, the output processing takes several tens of seconds. For this reason, the custom button is recommended when outputting images of record values. When using the custom button, the output process is partially handled on the Visualforce side.
*About enabling Lightning Web Security, ask your organization's system administrator or Salesforce help.
