Intermittent CORS violations when embedding Edge Delivery Services content in AEM Sites
This article explains how to troubleshoot intermittent Cross-Origin Resource Sharing (CORS) violations when embedding Adobe Experience Manager (AEM) Edge Delivery Services (EDS) resources into Adobe Experience Manager (AEM) Sites pages by using the aem.live embed approach. These issues can affect requests for JavaScript files, APIs, and other resources hosted on the EDS site, resulting in inconsistent loading behavior. To resolve the issue, validate CORS headers and investigate caching or propagation-related inconsistencies.
Description description
Environment
- Adobe Experience Manager (AEM) Sites (all versions)
- Edge Delivery Services (EDS)
Issue/Symptoms
- Resource requests fail intermittently because of CORS policy violations.
- Browser console errors indicate CORS-related failures.
- The issue occurs randomly and does not affect every request.
- Requests for embedded EDS resources, such as JavaScript files or APIs, may fail unexpectedly.
Root cause
Intermittent CORS violations can occur when the required response headers are not consistently returned with every request. This behavior can result from configuration issues, caching inconsistencies, or propagation delays across CDN or edge-delivery layers.
Resolution resolution
Follow the steps below to resolve the issue:
- Verify that the EDS site is configured to return the appropriate
Access-Control-Allow-Originheader for all resources accessed from AEM Sites pages, including JavaScript files and API endpoints. Confirm that the configured header values match the origins making the requests. - Review the HTTP Header Editor configuration and ensure that the header rules are applied consistently across all required paths and file types. Check for missing, overlapping, or conflicting rules that could result in inconsistent header delivery.
- Capture a HAR file while reproducing the issue. Enable Preserve log in the browser’s Network tab and review the failing requests to determine whether the
Access-Control-Allow-Originheader is present and whether it matches the request’sOriginheader. Also verify whether anyOPTIONSpreflight requests fail or return unexpected responses. - If the CORS headers are configured correctly but are missing intermittently, investigate CDN and edge-cache behavior. Test with cache-busting parameters or purge the relevant caches to rule out stale or inconsistent cached responses.
- If the issue persists, collect HAR files together with screenshots of the HTTP Header Editor configuration and provide them to Adobe Support for further analysis.
- Verify the resolution by confirming that requests from AEM Sites to EDS resources consistently succeed and that no CORS errors appear in the browser console.