We are building some integration consuming Salesforce custom REST Service. When we build the call in JavaScript everything works pretty well using the following code:
 

var payloadConnection = {
	companyId : '1',
	serviceCode : 'SalesforceLogin',
	endpoint : '/services/oauth2/token',
	method : 'POST',
	dataType : 'text',
	headers : {
		"content-type" : "application/x-www-form-urlencoded",
		"cache-control" : "no-cache"
	},
	options : {
		"mediaType" : "application/x-www-form-urlencoded"
	},
	params : {
		grant_type : 'password',
		client_id : SALESFORCE_INTERFACE_CLIENT_ID + '',
		client_secret : SALESFORCE_INTERFACE_SECRET + '',
		username : USERNAME + '',
		password : PASS_SECRET + ''
	}
};

var clientService = fluigAPI.getAuthorizeClientService();
var vo = clientService.invoke(JSON.stringify(payloadConnection));

The problem is when we try to build the same call in AJAX format we are getting CORS erros. The code we are using is:
 

$.ajax({
	method : 'POST',
	dataType : 'json',
	url : integrationParameters.URL_CONNECTION,
	headers : {
		"content-type" : "application/x-www-form-urlencoded",
		"cache-control" : "no-cache"
	},
	data : {
		"grant_type" : "password",
		"client_id" : integrationParameters.SALESFORCEINTERFACE_CLIENT_ID,
		"client_secret" :  integrationParameters.SALESFORCEINTERFACE_SECRET,
		"username" : integrationParameters.USERNAME,
		"password" : PASS_SECRET
	},
	success : function(data) {
		// success
	},
	error : function(data, errorThrown, status) {
		// error
	}
});

Even Ip's and websites from we are making the calls were added to CORS, IP Ranges and Network Access. When we use the same code in POSTMAN it works well.

We are getting the following error:

Failed to load resource: the server responded with a status of 400 (Bad Request)

Failed to load https://customDomain.my.salesforce.com/services/oauth2/token: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://website.com.br:8081' is therefore not allowed access.

The address returned in errors is also present in our configurations ("https://website.com.br:8081").


Does anyone have an idea about what is happening?

Thanks in advice for your help,
Lucas Carvalho