I'm trying to implement user authentication login and currently trying out to configure JSS connected mode to work with https (secure connection).

Following https://jss.sitecore.com/docs/techniques/authentication/sitecore-auth document.

I got my integrated site configured with https with local cert.

Now I'm try to use JSS start:connected to connect my app in secure channel, but I'm getting 500 error page. But I can see data is correctly returned from the Layout service in the network tab.

Following error appears on the browser console

Access to XMLHttpRequest at
from origin 'http://localhost:3000' has been blocked by CORS policy:
The value of the 'Access-Control-Allow-Credentials' header in the
response is 'true, true' which must be 'true' when the request's
credentials mode is 'include'. The credentials mode of requests
initiated by the XMLHttpRequest is controlled by the withCredentials

Any help would be highly appreciate


It looks like the Access-Control-Allow-Credentials value was added twice, hence the value is shown as "true, true".

Try removing it first then add again.

<remove name="Access-Control-Allow-Credentials" />
<add name="Access-Control-Allow-Credentials" value="true" />
  • Surely that was the reason. It seems to be adding from twice. So I just add remove entry and its started to work with data coming from secure path from layoutService – scFootsteps May 30 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.