Error 'XMLHttpRequest Cannot Load, No Access-Control-Allow-Origin' — CORS Error in Salesforce Visualforce Pages

This article describes how to resolve the CORS error using Salesforce's built-in HTTP(S) Proxy.

Step 1: Enable the HTTP(S) Proxy via Remote Site Settings

Salesforce provides a built-in HTTP(S) Proxy that allows Visualforce pages to make cross-domain requests through a single Salesforce-controlled endpoint, which bypasses the browser's CORS restriction.
To enable the proxy, first add your Salesforce instance as a Remote Site:

• Lightning Experience: Navigate to Setup > Security > Remote Site Settings
• Salesforce Classic: Navigate to Setup > Security Controls > Remote Site Settings

Click New Remote Site and add your Salesforce instance URL (for example, `). Ensure the HTTPS version is used.
See: Configure Remote Site Settings for full configuration steps.

Step 2: Update the AJAX Request URL to Use the Proxy Endpoint

After enabling the Remote Site, update your Visualforce page's AJAX request URL to route through the Salesforce HTTP Proxy endpoint instead of calling the external domain directly. Set the request URL to:
`<REDACTED>
This routes the request through Salesforce's proxy service, which handles the cross-domain request on behalf of the Visualforce page.

Note: If the Experience Cloud or Salesforce site associated with the Visualforce page is inactive, the CORS error is expected behavior. Ensure the site is active before troubleshooting further.