---
schema_version: "1"
id: 2def53ed39a88ec50cd105c67bd81b15155cc7957d3922b97fa78d0689860601
title: "Step 1: Enable Resource Sharing Across Domains"
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_identity_login_step_1.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_1.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c00a9aa54606620f3273c5d7acb9e918cbcf36c37cc75bab12381f3919525ecc
description: Embedded Login entails making web requests outside the website boundaries, but for security reasons, web requests are restricted to the current domain. To enable a website to share resources beyond its boundaries, the Salesforce admin adds trusted website domains to Salesforce’s Cross-Origin Resource Sharing (CORS) allowlist. CORS is an industry standard that enables web browsers to make requests from origins other than their own.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Step 1: Enable Resource Sharing Across Domains

Embedded Login entails making web requests outside the website boundaries, but for security reasons, web requests are restricted to the current domain. To enable a website to share resources beyond its boundaries, the Salesforce admin adds trusted website domains to Salesforce’s Cross-Origin Resource Sharing (CORS) allowlist. CORS is an industry standard that enables web browsers to make requests from origins other than their own.

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_warning.png)

Warning In Summer ’24, Salesforce made Embedded Login disabled by default. We recommend that you use the [web server flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&type=5&language=en_US), the [user-agent flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&type=5&language=en_US), or another redirect-based OAuth 2.0 flow instead of Embedded Login.

Embedded Login relies on third-party cookies, which are blocked or restricted in most browsers. And Embedded Login works only on Google Chrome and only as long as third-party cookies are allowed there by default.

Embedded Login populates the Access-Control-Allow-Origin response header with the origin (domain plus protocol) specified in the CORS allowlist. If CORS isn’t set up, the Access-Control-Allow-Origin header value is set to null, which effectively block all requests.

For Embedded Login to enable resource sharing across boundaries, the origin listed in the CORS allowlist—the Access-Control-Allow-Origin—must match the origin listed in the request. But an exact match isn’t required. Here are some examples.

   
| CORS | Request | Match? | Why? |
| --- | --- | --- | --- |
| https://salesforce.com | https://salesforce.com:6109 | ![Green checkbox indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | Accept requests from all ports in this domain. |
| https://salesforce.com:6109 | https://salesforce.com |   | Accept requests only from port 6109. |
| https://\*.salesforce.com | https://trailhead.salesforce.com | ![Green checkbox indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | Accept requests from all subdomains in this domain. |
| https://trailhead.salesforce.com | https://salesforce.com |   | The CORS allowlist must list this domain. |
| https://salesforce.com | https://salesforce.com/mySite | ![Green checkbox indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | Accept requests from Experience Cloud sites in this domain. |
| https://salesforce.com/mySite | https://salesforce.com |   | Accept requests only from this site. |
| https://salesforce.com/mySite | https://salesforce.com/mySite/login | ![Green checkbox indicating true](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/resources-global/_corporate/images/checkmark.png) | Accept requests from the login page of this site in this domain. |
| none | https://salesforce.com/mySite |   | The CORS allowlist must be set up to accept requests from other domains. |

1. From Setup, in the Quick Find box, enter CORS, then select **CORS**.
2. Click **New**.
3. Enter the domain where Embedded Login is deployed.
    
    For example, https://embeddedlogin.herokuapp.com allows access to all pages hosted on embeddedlogin.herokuapp.com.
    
    To handle multiple domains, you can use a regular expression to add them all to the allowlist at once. Or you can list each domain individually.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)
    
    Note By default, browsers cache the Embedded Login JavaScript, including your CORS settings, for 24 hours. You can change how often the cache refreshes with the `salesforce-cache-max-age` meta tag. If you change the value, test the change by clearing the cache between each change or using an incognito window.