---
schema_version: "1"
id: 0cf508c4782317eaaf3b505c96b04d69ac74c94fa2d690f7e283569b971e3691
title: Configure Salesforce CORS Allowlist
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/extend_code_cors.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.extend_code_cors.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a4b1c254814cd104c6eec365d501621c09fef1c05f0f94030458ee055e0fb900
description: Cross-Origin Resource Sharing (CORS) allows web browsers to request resources from other origins. For example, using CORS, the JavaScript for a web application at https://www.example.com can request a resource from https://www.salesforce.com. To allow access to supported Salesforce APIs, Apex REST resources, and Lightning Out from JavaScript code in a web browser, add the requesting origin to your Salesforce CORS allowlist. For Lightning apps that allow web browsers to make requests from their orgs, CORS allowlist prevents requests to Lightning apps unless the request comes from an approved URL. The allowlist is in effect for your My Domain URL and api.salesforce.com.
products:
  - Security
release: "264"
---
# Configure Salesforce CORS Allowlist

Cross-Origin Resource Sharing (CORS) allows web browsers to request resources from other origins. For example, using CORS, the JavaScript for a web application at https://www.example.com can request a resource from https://www.salesforce.com. To allow access to supported Salesforce APIs, Apex REST resources, and Lightning Out from JavaScript code in a web browser, add the requesting origin to your Salesforce CORS allowlist. For Lightning apps that allow web browsers to make requests from their orgs, CORS allowlist prevents requests to Lightning apps unless the request comes from an approved URL. The allowlist is in effect for your My Domain URL and api.salesforce.com.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Developer</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with API access enabled in: Professional Edition</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d91440e57">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d91440e57 ">To create, read, update, and delete:</td>
            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d91440e57 ">Modify All Data</td>
          </tr>
        </tbody>
      </table>

These Salesforce technologies in your org support CORS.

- Apex REST
- Bulk API
- Bulk API 2.0
- Connect REST API
- Lightning Out
- REST API
- CRM Analytics REST API
- User Interface API

Add an origin serving the request code to the CORS allowlist. If a browser that supports CORS makes a request to an origin in the allowlist, Salesforce returns the origin in the `Access-Control-Allow-Origin` HTTP header along with any additional CORS HTTP headers. If the origin isn’t included in the allowlist, Salesforce returns HTTP status code 403.

1. From [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), use the Quick Find box to find and select **CORS**.
2. Select **New**.
3. Enter a resource in Origin URL Pattern.
    
    ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_tip.png)
    
    Tip The origin URL pattern doesn’t always match the URL that appears in your browser's address bar.
4. Save your changes.

The origin URL pattern must include the HTTPS protocol (unless you’re using your localhost) and a domain name. It can also include a port. The wildcard character (\*) is supported and must be in front of a second-level domain name. For example, https://\*.example.com adds all subdomains of example.com to the allowlist.

The origin URL pattern can be an IP address. But an IP address and a domain that resolve to the same address aren’t the same origin, and you must add them to the CORS allowlist as separate entries.

Google Chrome™ and Mozilla® Firefox® browser extensions are allowed as resources in API version 53 (Winter ‘22) or later. Chrome extensions must use the prefix `chrome-extension://` and 32 characters without digits or capital letters, for example `chrome-extension://abdkkegmcbiomijcbdaodaflgehfffed`. Firefox extensions must use the prefix `moz-extension://` and an 8-4-4-4-12 format of small alphanumeric characters, for example `moz-extension://1234ab56-78c9-1df2-3efg-4567891hi1j2`.

You can get a successful response when requesting a REST resource in a CORS preflight test, but receive an unsuccessful response to the actual request. This discrepancy can occur when the resource is deleted after the preflight test and before the request is made. It can also occur if the resource doesn’t exist. A CORS preflight confirms if resources can be passed between servers, but doesn’t check if a specific resource exists or not. CORS preflight requests are typically issued automatically by a browser.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png)

Note To access certain OAuth endpoints with CORS, other requirements apply. See [Enable CORS for OAuth Endpoints](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_endpoints_cors.htm&type=5&language=en_US).

#### See Also

- [Limit Interactions with External URLs and Origins](https://help.salesforce.com/s/articleView?id=xcloud.security_external_interactions.htm&release=264.0.0&type=5 "In our connected world, interaction with external websites and origins is a necessity. To protect your network and data, configure allowlists and enable settings that limit how Salesforce and external origins interact. And limit redirections that originate in Salesforce to URLs that you trust.")