---
schema_version: "1"
id: a041bda28fa15b4388e7cd89d7d84d2930817b68bf1f3ed81bf0bb738e79e27a
title: CorsWhitelistOrigin
collection: legacydeveloper
version: current
locale: en-us
portal_url: https://docs.salesforce.com/legacydeveloper/current/en-us/api_meta/meta_corswhitelistorigin.md
canonical_url: https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/meta_corswhitelistorigin.htm
source_site: developer.salesforce.com
content_type: documentation
content_hash: 172dedcdb7b30e162fa23b0d9e391300ffcc8bc6ada54dcafcd1790fdb46e2c9
description: Represents an origin in the CORS allowlist.
---
# CorsWhitelistOrigin

Represents an origin in the CORS allowlist.

![Important](https://developer.salesforce.com/docs/atlas.en-us.api_meta.meta/api_meta/images/icon_note_important.png)

#### Important

Where possible, we changed noninclusive terms to align with our company value of Equality. Because changing terms in our code can break current implementations, we maintained this metadata type’s name.

## File Suffix and Directory Location

CorsWhitelistOrigin components have the suffix .corswhitelistorigin and are stored in the corswhitelistorigins folder.

## Version

CorsWhitelistOrigin components are available in API version 32.0 and later.

## Fields

<table class="featureTable sort_table" summary="">



          <thead class="thead sorted" align="left">
            <tr>
              <th class="featureTableHeader  " id="d296354e87">Field Name</th>

              <th class="featureTableHeader  " id="d296354e90">Field Type</th>

              <th class="featureTableHeader  " id="d296354e93">Description</th>

            </tr>

          </thead>

          <tbody class="tbody">
            <tr>
              <td class="entry" headers="d296354e87" data-title="Field Name"><span class="keyword parmname">urlPattern</span></td>

              <td class="entry" headers="d296354e90" data-title="Field Type">String</td>

              <td class="entry" headers="d296354e93" data-title="Description">A URL pattern for the origin. <p class="p">The origin URL pattern must include the HTTPS
                  protocol and a domain name, and can include a port. The wildcard character (*) is
                  supported and must be in front of a second-level domain name. For example,
                  <span class="ph filepath">https://*.example.com</span> adds all subdomains of
                  <span class="ph filepath">example.com</span> to the allowlist.
                </p>
                <p class="p">Google Chrome™ and
                  Mozilla® Firefox® browser extensions are also allowed as resources in API version
                  53 and later. Chrome extensions must use the prefix <samp class="codeph nolang">chrome-extension://</samp> and 32 characters without
                  digits or capital letters, for example <samp class="codeph nolang">chrome-extension://abdkkegmcbiomijcbdaodaflgehfffed</samp>. Firefox
                  extensions must use the prefix <samp class="codeph nolang">moz-extension://</samp> and an 8-4-4-4-12 format of small alphanumeric
                  characters, for example <samp class="codeph nolang">moz-extension://1234ab56-78c9-1df2-3efg-4567891hi1j2</samp>.</p>
                <p class="p">The origin
                  URL pattern can be an IP address. But an IP address and a domain that resolve to
                  the same address aren’t the same origin, and you must add them to the CORS
                  allowlist as separate entries.</p>
              </td>

            </tr>

          </tbody>

        </table>

## Declarative Metadata Sample Definition

Here’s an example package manifest used to deploy or retrieve the CorsWhitelistOrigin metadata for an organization.

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types\>
        <members\>\*</members\>
        <name\>CorsWhitelistOrigin</name\>
    </types\>
    <version\>32.0</version\>
</Package\>

Here’s an example of a CorsWhitelistOrigin component.

<?xml version="1.0" encoding="UTF-8"?>
<CorsWhitelistOrigin xmlns="http://soap.sforce.com/2006/04/metadata">
    <developerName\>CorsWhitelistEntry1</developerName\>
    <urlPattern\>https://\*.example.com</urlPattern\>
</CorsWhitelistOrigin\>

## Usage

[CORS](http://www.w3.org/TR/cors/ "HTML (New Window)") (cross-origin resource sharing) is a W3C recommendation that enables Web browsers to request resources from origins other than their own. For example, using CORS, a JavaScript script at https://www.example.com could request a resource from https://www.salesforce.com.

If a browser that supports CORS makes a request to an origin in your allowlist, Salesforce returns the origin in the Access-Control-Allow-Origin HTTP header, along with any additional CORS HTTP headers. If the origin isn’t allow listed, Salesforce returns HTTP status code 404.

## Wildcard Support in the Manifest File

This metadata type supports the wildcard character \* (asterisk) in the package.xml manifest file. For information about using the manifest file, see [Deploying and Retrieving Metadata with the Zip File](https://developer.salesforce.com/docs/atlas.en-us.264.0.api_meta.meta/api_meta/file_based_zip_file.htm).