I tried to follow this guide to login from the JSS-app, but I get an error when posting:

Access to XMLHttpRequest at 'https://myApp/sitecore/api/ssc/auth/login?sc_apikey={APIKey}' from origin 'http://localhost:3000' has been blocked by CORS policy: 
The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. 
The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

I've tried calling the dataFetcher.js's internal method (axios), but it doesn't work either.

My best fix is removing the withCredentials from dataFetcher.js and add the following to web.config:

    <remove name="X-Powered-By"/>
    <add name="Access-Control-Allow-Headers" value="Content-Type, Accept, X-Requested-With, Session"/>
    <add name="Access-Control-Allow-Credentials" value="true"/>

But I have no idea what else is using the dataFetcher, so I'm not sure this is the best method to get around it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.