To resolve the CORS issue I have added the following headers in the web.config file of SharePoint 2013

<add name="Access-Control-Allow-Origin" value="http://localhost:4200" />
<add name="Access-Control-Allow-Headers" value="Content-Type,Accept,X-FORMS_BASED_AUTH_ACCEPTED,crossDomain,credentials,X-RequestDigest " />
<add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
<add name="Access-Control-Allow-Credentials" value="true" />    

After this I am able to execute the SharePoint REST Api AJAX calls from the cross domain. But now I want to add another URL to the header

<add name="Access-Control-Allow-Origin" value="http://localhost:4200" />

I cannot put * in the value as I am also allowing the credentials. Is there any way that I can add one more URL to this header.

Thanks in advance..

  • were you able to achieve post action in cross(edge browser), if so can you share example. Commented Oct 24, 2019 at 12:18
  • i believe it should work on edge as well. I have only tested it in chrome. if it is not working in edge can you post the issue as well? Commented Oct 30, 2019 at 7:57

2 Answers 2


Finally got it working using URL Rewrite.

         <add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" />
         <add name="Access-Control-Allow-Methods" value="POST,GET,OPTIONS,PUT,DELETE" />
                <clear />                
                <rule name="AddCrossDomainHeader">
                    <match serverVariable="RESPONSE_Access_Control_Allow_Origin" pattern=".*" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
                        <add input="{HTTP_ORIGIN}" pattern="(http(s)?://((.+\.)?domain1\.com|(.+\.)?domain2\.com|(.+\.)?domain3\.com))" />
                    <action type="Rewrite" value="{C:0}" />

From this method we can add multiple cross domain URL's in our web.config

Original answer thread. LINK


You could set Access-Control-Allow-Origin dynamically in Global.asax.

<%@ Assembly Name="Microsoft.SharePoint"%>
<%@ Application Language="C#" Inherits="Microsoft.SharePoint.ApplicationRuntime.SPHttpApplication" %>

<script runat="server">
     void Application_BeginRequest(object sender, EventArgs e) {       
Response.AddHeader("Access-Control-Allow-Origin", Request.UrlReferrer.GetLeftPart(UriPartial.Authority));

                  Response.AddHeader("Access-Control-Allow-Credentials", "true");

                  Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");

Check the thread here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.