Headless 360Intermediatecorscspsecurityweb
Implement CORS and CSP for headless web apps calling Salesforce
Real World Scenario
Browser console shows CORS errors blocking Experience Cloud API calls from custom domain.
Expected Answer
• Configure CORS allowlist for exact production and staging origins
• Avoid wildcard origins with credentials
• CSP headers restricting script sources preventing XSS
• Use BFF to proxy calls avoiding browser-exposed tokens where possible
• Test preflight OPTIONS handling in CI
• Document required Salesforce setup steps for new domains
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Configure CORS allowlist for exact production and staging origins Also consider: Avoid wildcard origins with credentials In practice: CSP headers restricting script sources preventing XSS Balance speed of delivery with maintainability.
Architect Perspective
CORS misconfiguration is deployment checklist item—automate verification in pipeline.