CORS Support in the Experience Cloud Identity Service

Browsers use Cross Origin Resource Sharing (CORS) to request resources from a domain other than the current domain. The Experience Cloud Identity Service supports CORS standards that enable these client-side, cross-origin resource requests. The ID service reverts to JSONP requests on older browsers or browsers that do not support CORS.

Problems with Same-Origin Policies and ID Service Requests

Same-origin policies are security controls or restrictions enforced by a web browser. When enforced on this level, the web browser itself determines if a request for resources made from one page to another will be permitted or blocked. To determine if a request is a same-origin request, the browser compares:

The browser allows a request to succeed if both pages share these characteristics and blocks resource requests if they do not.

CORS Resolves Problems with Same-Origin Policies

CORS provides a secure, effective way to request resources across different domains. The CORS specification includes a set of HTTP headers that browsers use to send, receive, and evaluate resource requests. Evaluating a resource request is called a preflight check. This check lets browsers and servers determine which requests are allowed or blocked. The preflight check is transparent to the app, API, or script that requests a resource. Two headers that are important in the resource request process include:

Let’s take a look at how these headers work. In this example, say we have a financial services company that has implemented the Experience Cloud ID service on their site, www.finance-website.com. The following table defines how the CORS request and response headers check for access to a resource.

See also useCORSOnly.