We are using Sitecore 9.3 with SXA hosted on premises.

We have angular application on frontend, which has different domain and is hosted on Azure Cloud. It makes request to sitecore ItemService API to access the Sitecore content.

Current we are using Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy.

But a vulnerability was reported that this API can be accessed by any other sites.

How can we configure Access-Control-Allow-Origin for the Sitecore item service API so that only our angular application which is hosted on Azure cloud can access the Item Service API and other sites are not able to access it?

3 Answers 3


In order to configure CORS on item service, you can configure them in either of the 2 ways.

  1. Inside the Sitecore.Services.Client.config, you can add the allowed origins as below:
  <allowedOrigins hint="list:AddOrigin">
  1. You can configure the CORS Origins inside the OData Item API key as below:

enter image description here

This way will allow item service to be accessible only through angular application configured above.

Hope that helps!!!

  • I will try this approach. But should I change the security policy from Sitecore.Services.Infrastructure.Web.Http.Security.ServicesOnPolicy to Sitecore.Services.Infrastructure.Web.Http.Security.ServicesLocalOnly along with the change that you mentioned?
    – NewbieHere
    Commented Apr 18 at 6:53
  • It should be ServicesOnPolicy only, as you want to to access it from remote client as well, i guess above mentioned setting should solve your problem
    – Rinku Jain
    Commented Apr 18 at 9:27
  • This allowedOrigins setting has no impact. I have tried it earlier as well and tried it today also.
    – NewbieHere
    Commented Apr 18 at 9:40
  • OData Item Key is not present. Should I create it?
    – NewbieHere
    Commented Apr 18 at 9:40
  • 1
    @NewbieHere You can add the api key and configure CORS there...You should be good to go then!!!..you can keep the name for API key as you wish...
    – ckhanna
    Commented Apr 18 at 12:00

If you aim to restrict CORS to a specific origin, there are three configuration options available as mentioned below:

Global configuration : You can add allow origin inside Sitecore.Services.Client.config as below

<allowedOrigins hint="list:AddOrigin">

API Key Configuration: Alternatively, you can set up a service to utilize an API key. You specify the permitted origins in the CORS Origins field of an API key item. If the API key is absent, you can create a new one

EnableCors Attribute Usage: Another approach is to activate CORS by applying the EnableCors attribute to a controller class and defining the origins, headers, and methods parameters accordingly:

[EnableCors(origins: "*", headers: "*", methods: "*")]
public class MyController : ServicesApiController { ... }

If you also intend to deactivate Anonymous User access, you can set Sitecore.Services.AllowAnonymousUser to false. This action will prohibit any anonymous user access to your default API endpoint. For a custom API endpoint, you can apply the following patch at the controller level to block anonymous user access:

[AnonymousUserFilter(AllowAnonymous = AllowAnonymousUserOptions.UseConfig , ConfigSettingName = "Sitecore.Services.AllowItemServiceAnonymousUser")]
public class MyController : ServicesApiController { ... }
  • This information is also present in the sitecore documentation. But did not help much. Thanks for answering
    – NewbieHere
    Commented Apr 18 at 11:10

Sitecore provides CORS support for the Item Service and the OData Item Service. You can configure CORS in three ways.

  • Globally for all Web API services (configured in the Sitecore.Services.Client.config file).

  • Using an API key.

  • Using the EnableCors attribute.

You can easily configure it using API Key. If it is not present then

you create API key items in the \sitecore\system\Settings\Services\API Keys folder, using the sitecore\templates\System\Services\API Key template. You must publish the items you create.

Follow this document for more details.


If you configure a service to use an API key, Sitecore resolves the allowed origins from this key, provided in the request.

You specify the allowed origins in the CORS Origins field of an API key item.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.