Using Sitecore 9.1 Trying to get FXM working and seeing the Cors policy error (which I thought I had fixed previously but nevermind).

I have set the AllowedOrigins domains in a patch file.

I also tried updating the web.config to include the verbs: enter image description here

I had also tried to tie this into a location element but this just caused the server to 500 error.

<location path="sitecore/api/ssc/Beacon/Service/beacon">
                  <add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" />
                  <add name="Access-Control-Allow-Methods" value="POST,GET" />

Am struggling to find any documentation on adding these methods so hopefully, I've just done something wrong with that aspect.

  • 1
    Sorry, I can't comment yet, but want to help. Can you try adding "OPTIONS" verb to Access-Control-Allow-Methods? Also, for 500 error, can you check logs for the actual error, maybe it is something unrelated to this config? I assume you have setup external website in FXM?
    – MaksymD
    Aug 30, 2019 at 1:11
  • @MaksymD it was definitely related to the location config I included above, as I deleted it again and the site resumed working :) I will try the OPTIONS verb thanks.
    – Jen
    Aug 30, 2019 at 6:04

2 Answers 2


Turns out that the WAF was blocking the tracking request due to triggering OWASP rules. Updating that configuration made the Cors exception go away! So I did not have to modify the methods from what I had posted above.


I am facing the same issue it is because I am enabling CORS from webconfig and I cannot remove it because we are using 3rd party libraries in Sitecore JSS it is working fine but on the Controller level in the Action Method it is not working it through the same error so I added this above my action method

 [EnableCors(origins: "*", headers: "Content-Type", methods: "GET,POST")]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.