We are getting a 403 error when creating an external site in console logs and the following error message in External Site page:

Could not validate beacon script - The remote server returned an error: (403) Forbidden.

enter image description here

I see the following error in console log:

enter image description here

When I access the API Url directly I get the following message:

{"Message":"An error has occurred.","ExceptionMessage":"The required anti-forgery form field \"__RequestVerificationToken\" is not present.","ExceptionType":"System.Web.Mvc.HttpAntiForgeryException","StackTrace":"   at System.Web.Helpers.AntiXsrf.TokenValidator.ValidateTokens(HttpContextBase httpContext, IIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken)\r\n   at System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext)\r\n   at Sitecore.Web.Http.Filters.ValidateHttpAntiForgeryTokenAttribute.OnAuthorization(HttpActionContext actionContext)"}

Any help with this will be great.

  • Not sure how your external app is configured and built, but can you verify if CORS is enabled in your external application? Commented Mar 25, 2021 at 9:42
  • Yes, cors is enabled in external site Commented Mar 25, 2021 at 9:55
  • Can you verify if you have enabled the Sitecore.Services.Client.FXM.Enabler.config.disabled config file located at /App_Config/Include/FXM? Commented Mar 25, 2021 at 10:15
  • Are you making call from http to https or https to https?
    – Alexander
    Commented Jan 22, 2022 at 11:47

1 Answer 1


Please make sure to have enabled the Sitecore.Services.Client.FXM.Enabler.config.disabled config file located at /App_Config/Include/FXM and that CORS is enabled on the external website.

Regarding the anti-forgery error, only the Experience Analytics application should access the API endpoints. You are not supposed to access them directly from the browser—it's not going to work since your request does not include an anti-forgery token. So receiving that error is in fact intended behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.