CORS configuration in SXA

Question

I'm trying to use the CORS settings under Site Grouping, but they don't seem to do anything. I also can't seem to find any documentation about it. Does anyone know of documentation or know what the secret is to get these to work?

I don't get any errors, they just don't seem to have any impact on the response headers in any way. I have verified that the changes have been published properly.

This is the settings I'm talking about:

Answer 1

I had raised a Sitecore support ticket for this same issue and below is the response that I got.

• Please find below the documentation of how to include credentials on cross-origin requests for an SXA site:

https://doc.sitecore.com/developers/sxa/19/sitecore-experience-accelerator/en/include-credentials-on-cross-origin-requests.html

• CORS functionality in the SXA is based on the following article: https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api, where web service is SXA site and web client is created according to your needs.

• The CORS Settings (available in SXA site) only apply to SXA Data Modeling. You can find more information and samples about the SXA Data Modeling here: https://doc.sitecore.com/developers/sxa/16/sitecore-experience-accelerator/en/introducing-sxa-data-modeling.html

To make the client communicate with the SXA site you should perform the following steps:

Create a page with the JSON component.

• Open page1 in the Experience Editor;
• Choose "JSON" device in the "Experience (tab)->Device";
• Add the necessary "JSON" component, for example, "JSON List". Please see the video for details: http://www.screencast.com/t/Fha6PWGB

Make a JSON device valid for correct resolving during the request from the client, for example, make a JSON device as default one or add some query string: https://www.screencast.com/t/0MYGLrwCS

Publish site;

• Create a client as described in the following article: https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api
• Set service URL on the client to the following one: 'http://SXA_Site_hostName/page1?device=1'. Please see the video for details: http://www.screencast.com/t/gPpqJj27t
• Each CORS entry (that is located under SXA site definition item: "/sitecore/content/New tenant/New site/Settings/Site Grouping/New site/CORS/default") defines a list of parameters that client must satisfy to access this particular site (an origin from where the request is accepted, allowed request methods, allowed request headers, etc )

For example, if we change "Allow Origin" from "*" to "http://test", we will not be able to get a response from the server. Please see the video for details: http://www.screencast.com/t/MkSxzXP0

Answer 2

The CORS is to configure cross domain request!! You will not get any error as it is not related to your domain and hosting setup, it will impact to other domain trying to access your APIs.

https://doc.sitecore.net/sitecore_experience_platform/82/developing/developing_with_sitecore/sitecoreservicesclient/the_entityservice_and_cors

https://www.w3.org/TR/cors/

You can refer to below example for clear understanding and use of CORS.

https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api