Since Spring 15 it is possible to implement CROS (Cross Origin Resource Sharing) to work around the same origin policy issue. This is more useful for external domains that are calling into a Salesforce hosted API.
OLD
I'm not sure why salesforce is using different domains. But the issue can be addressed using the built-in HTTP(S) Proxy.
You can enable the proxy in the standard setup menu:
Setup -> Security Control -> Remote Sites / Remote Proxy Settings
To solve xmlhttprequest cannot load no access control allow origin, you can add your own salesforce instance. e.g. eu1.salesforce.com (don't forget to enable https)
In a second step you have to modify your ajax request:
var credential = ' OAuth ' + '{!GETSESSIONID()}'; // native VF function var apiUrl = "https://na1.salesforce.com/services/data/v26.0/chatter/users/me"; $.ajax({ type: "GET", // for community pages, use whole community url including path, e.g. // https://logan.blitz01.t.force.com/customers/services/proxy. url: "https://c.na1.visual.force.com/services/proxy", contentType: 'application/json', cache: false, success : function(response) { alert("result" + response); }, error : function(response) { alert("Failed" + response); }, dataType: "json", beforeSend: function(xhr) { xhr.setRequestHeader('SalesforceProxy-Endpoint', apiUrl); xhr.setRequestHeader("Authorization", credential); xhr.setRequestHeader('X-User-Agent', 'MyClient'); } });
Salesforce offers great functionality to edit the request header. It's possible to change or add a headers to your http response. However, I tried to overwrite several fields including the http status code, cross-origin. But it didn't work out the way I expected.
==> The best solution is to use the fully documented HTTP Proxy service from salesforce.
