---
title: "Include credentials on cross-origin requests"
slug: "include-credentials-on-cross-origin-requests"
abstract: "Learn how to change the CORS settings and include credentials on cross-origin requests."
---
# Include credentials on cross-origin requests

A web application executes a cross-origin HTTP request when it requests a resource that has a different origin (domain, protocol, and port). Cross-origin Resource Sharing (CORS) is a mechanism that uses additional HTTP headers to tell a browser to let a web application running at one origin (domain) have permission to access selected resources from a server at a different origin.

By default, CORS does not include cookies on cross-origin requests. To include credentials on cross-origin requests, you must change the CORS settings.

To include credentials on cross-origin requests:

1. Navigate to your site definition item: */sitecore/content/<site collection>/<site>/Settings/Site Grouping/<site>/CORS* and click **default**.
2. In the **CORS** section, in the **Allow Origin** field, enter the URL of the site.

    > [!note]
    > If the Allow Origin field value is empty or equal to "\*", SXA ignores the Allow Credentials check box.

3. Select the **Allow Credentials** check box.

    ![Go to Site, CORS and click default to select the Allow Credentials check box.](https://doc.sitecore.com/api/markdown-image/xp/en/developers/sxa/105/sitecore-experience-accelerator/images/SXA-CORS.png)

For example:

When you access `http://sxa` from `http://fake`, without setting the **Allow Credentials** and **Allow Origin** fields, with the following script:

```xml
<script type="text/javascript">
        var xhr = new XMLHttpRequest();
        xhr.open('GET', 'http://sxa/?device=1', true);
        xhr.withCredentials = true;
        xhr.send(null);
        console.log("test");
    </script>

```

The response is:

*Access to XMLHttpRequest at 'http://sxa/?sc_device=json' from origin 'http://fake' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.*

When you do set the **Allow Credentials** and **Allow Origin** fields:

![SXA-CORS-allow.png](https://doc.sitecore.com/api/markdown-image/xp/en/developers/sxa/105/sitecore-experience-accelerator/images/SXA-CORS-allow.png)

The response is valid, with proper response headers without any errors:

![SXA-CORS-response.png](https://doc.sitecore.com/api/markdown-image/xp/en/developers/sxa/105/sitecore-experience-accelerator/images/SXA-CORS-response.png)