DocumentationExperience Cloud KCS

Cannot edit or add components in Universal Editor due to CORS and HTTP 500 errors

Last update: October 27, 2026

If editing or adding components in the Adobe Experience Manager (AEM) Universal Editor fails with CORS policy errors and HTTP 500 responses, remove Adobe origins from your custom CORS configuration and deploy the updated configuration.

Description description

When using the Universal Editor in AEM as a Cloud Service, you encounter a situation where pages load successfully, but editing existing components or adding new components fails. In this scenario, the browser console displays a CORS (Cross-Origin Resource Sharing) error related to the x-aem-affinity-type header, and the Universal Editor Service /details request returns an HTTP 500 Internal Server Error. This issue typically affects all pages under a given content path and may occur if a custom CORS configuration is deployed that explicitly lists certain origins.

Environment

Adobe Experience Manager as a Cloud Service (all versions)

Symptoms

  • Universal Editor loads pages, but editing or adding components fails.
  • Browser console shows a CORS error: the ‘x-aem-affinity-type’ header is not allowed by Access-Control-Allow-Headers in the preflight response.
  • The Universal Editor Service /details request returns HTTP 500 Internal Server Error.

Cause

The CORS preflight response from AEM Author does not include the x-aem-affinity-type header in Access-Control-Allow-Headers, causing the browser to block requests from the Universal Editor and resulting in HTTP 500 errors from the service. This is often due to a custom CORS configuration that explicitly lists certain origins.

Resolution resolution

Follow these steps to resolve the issue:

  1. Review your custom CORS configuration in AEM as a Cloud Service.

  2. Check whether the following origins are explicitly listed in the allowed origins:

  3. Remove these origins from the custom CORS configuration if they are present.

  4. Ensure that the Universal Editor is being accessed under the AEM domain, not from an external origin.

  5. Deploy the updated CORS configuration.

  6. Test editing and adding components in the Universal Editor to confirm the issue is resolved.

recommendation-more-help
experience-cloud-kcs-help-kbarticles