---
title: "Cross-Origin Resource Sharing (CORS) Configuration"
slug: "cross-origin-resource-sharing-cors-configuration"
description: "Cross-Origin Resource Sharing is a mechanism that controls the access to web page resources from domains other than the domain serving the page."
tags: ["System Administrators", "Modify CORS settings"]
updated: 2024-02-21T18:29:16Z
published: 2024-02-21T18:29:16Z
canonical: "help.rapididentity.com/cross-origin-resource-sharing-cors-configuration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cross-Origin Resource Sharing (CORS) Configuration

## Cross-Origin Resource Sharing (CORS)

Cross-Origin Resource Sharing (CORS) is a mechanism that controls the access to web page resources from domains other than the domain serving the page and can be configured in RapidIdentity by tenant administrators to restrict access at a more granular level than the default settings.

Use the following instructions to modify the CORS setting in RapidIdentity.

WARNINGIncorrect CORS configuration settings can restrict all access to RapidIdentity, even Tenant and System Administrator access. Changes to the default CORS settings should only be made by administrators with a thorough understanding of Cross-Origin Resource Sharing configuration.  
  
Consult the following resources for information regarding Cross-Origin Resource Sharing (CORS):

- [Cross-origin resource sharing Wikipedia](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing)
- [Cross-origin resource Sharing Mozilla](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)

Tenant and System Administrators can modify CORS settings in RapidIdentity by navigating to Configuration > General > Settings > CORS in the RapidIdentity Portal. Click **Save** when each subsection has been updated as desired.

#### Allowed Methods

The **Allowed Methods** section lists HTTP request methods that can be used to access resources using cross-origin requests and defines the methods to be included in the *Access-Control-Allow-Methods* header in pre-flight responses.

**Default Values:** GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS

![CORS_-_Allowed_Methods.png](https://lh7-us.googleusercontent.com/RBrtT62-dACfC8WLW-MDDh0ry6TOaHVnK2Ooz_CREvk7LX4ZDQKpqBN85KHuXYDrtZU40HcVQJdreSPy_5HPZkRCjjbhkF-tC2fIP6fUlfGveLKcvkMeoBbm4sVuVrwu2Ozw6yLoEngC5mmwfX6-RaA)

#### Allowed Headers

The **Allowed Headers** section lists HTTP request headers that can be used when making cross-origin requests. These headers will also be returned in the *Access-Control-Allow-Headers* header in pre-flight responses.

**Default Values:** Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, idauto.debug, X-idauto-debug, Authorization

![CORS_-_Allowed_Headers.png](https://lh7-us.googleusercontent.com/qrQcmSR55hwAKm82vaidkXjlrNBXlNnjH7NE5py4tN6wdsFN4qN8mn0wX9ibQt2arFYmM9Vi0hvoAelpY8ySjJ6hdFnGwLCNjc_hSjNGhcV-fOcVkdH35h6J1NFnc19XxMj8qNODnkDw98ClBGKEAk0)

#### Allowed Origins

The Allowed Origins section lists all origins allowed to access resources on the server using cross-origin requests. A value of * indicates that resources are allowed to be accessed from any origin.

![](https://lh7-us.googleusercontent.com/gnpBWCjE28q0aeEbpW2WRFHfVS1YFbTnw1jeNpYmitLn93dXl2SMn-wWS1c9oZ2-re9jab_x7MJXwUnM0J3X_kKwGCjfyuGA4xd3mw9vPQo6c1udY-GzQ8g2ixZ2abH4MzCabaxy_kLnCRLGe8vpdLU)

NOTES:

1. ***** is not secure; Identity Automation recommends including an accurate domain value during initial configuration.
2. If configuring RapidIdentity for SAML authentication against an Identity Provider in a different domain, that domain may require being added as Allowed Origin. The Allowed Origin value should be formatted as https://identity_provider_domain.

#### Exposed Headers

The **Exposed Headers** section lists all headers other than simple response headers that browsers will be allowed to access. These are the headers which will be included in the *Access-Control-Expose-Headers* header in pre-flight responses.

**Default Value:** [blank]

![CORS_-_Exposed_Headers.png](https://lh7-us.googleusercontent.com/WW0m5GUM4zo1G_8lwW7_466ztge0dd18ZeWy_pmg6rKhkQwxCNNPHhl2PxomPnOfF13FBn5sUSyqZ2EgzANuz6Kf9a3i4Yjl3_U62_ieKbykyLJed0XF62CIxzOx-r6Wx2BLhF6cYic6IvlPixib8io)

#### Max Age (seconds)

The **Max Age** subsection defines the number of seconds a browser is allowed to cache the result of a pre-flight request. This will be included as the *Access-Control-Max-Age* header in pre-flight responses. A negative value will prevent the header from being included in pre-flight responses.

**Default Value:** 1800

![CORS_-_Max_Age.png](https://lh7-us.googleusercontent.com/KcQnM280-V9SnHGMMBDKpY8I2VJOHRQQ34izi4ZYuiml3g1ufPidEZHhWIST6VL-XTGETNGq1XW8n9pEqVPCpti8KaYlqOqztl7Q_IjqRuU5NYwDtHJdJPWjxGEUHOjGAGHrZmUqB82nCeieyxDecYc)

#### Supports Credentials

The **Supports Credentials** option, when checked, responds to browser requests with *Allow Credentials* in order to improve security on cross-origin requests.

**Default Value:** [blank]

![Supports_Credentials_-_Both_platforms.jpg](https://lh7-us.googleusercontent.com/Z1KAp1tSWuPpm7yLhlMVWUG70HcP_OXbvZv7VkjQKQiDJmrzMuFzloe0nyD6h_vyKsc0Q4Pj7bgIz6-U7nOH9J0k4qe0GwrADkTB7UEYx-uNelC0uuAnE_-MfU32CkTKebJ06p4lo6Go33R60XCxGQo)

#### Custom crossdomain.xml

A **cross-domain** policy file is an XML document that grants a Flash Player client permission to handle data across domains. To populate this subsection, simply cut and paste the code for the desired cross-domain policy .xml file.

**Default Value:** [blank]

![CORS_-_Custom_crossdomain_xml.png](https://lh7-us.googleusercontent.com/p2_C_tLTHTggJUDodGjhR21t4IjjJ1ef05mYjtTexbAdC9S5Uy1_Rl7XkrmkMV_Svwzs3ZxZs3LtPj4DVAL07gaoji_2CbJAXcMWjSxO5OerYf_L5nVHvJdpfQucvLfDb6jczWagnSnwbJoGTiCWEyA)

NOTE:

The default crossdomain.xml file served by the RapidIdentity server is constructed from the rest of the CORS configuration as described above. A custom crossdomain.xml value should only be required if the default is not sufficient.

The default crossdomain.xml file can be accessed in a browser at https://[rapididentity_domain]/crossdomain.xml.