I have SharePoint 2019 on premise communication site which manages the public facing site. My search is working on on-premise site but it shows the error message which says

Access to XMLHttpRequest at 'On premise site' from origin 'public facing site' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I assume that I need to put the rules and add allow content origin policy in the web.config file inside the <system.webServer>. What and how should I add the allow customHeaders? The existing customHeaders

<add name="X-Content-Type-Options" value="nosniff" />
<add name="X-MS-InvokeApp" value="1; RequireReadOnly" />

Should I delete it? I tried adding the following but does not work for me.

         <add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" />
         <add name="Access-Control-Allow-Methods" value="POST,GET,OPTIONS,PUT,DELETE" />
                <clear />                
                <rule name="AddCrossDomainHeader">
                    <match serverVariable="RESPONSE_Access_Control_Allow_Origin" pattern=".*" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
                        <add input="{HTTP_ORIGIN}" pattern="(http(s)?://((.+\.)?domain1\.com|(.+\.)?domain2\.com|(.+\.)?domain3\.com))" />
                    <action type="Rewrite" value="{C:0}" />
  • did you try to disable CORS on your browser ? Commented Oct 27, 2022 at 7:46
  • Nope, I managed to tackle this. Thanks Commented Oct 27, 2022 at 15:29

1 Answer 1


Your SharePoint Communication site is either trying to send multiple Access-Control-Allow-Origin headers, or one Access-Control-Allow-Origin header with multiple values. I believe none is allowed.

So the idea is you need to fix your SPConfig so that it only

  • sends this header once
  • specifies a single value

Go to SP Admin Center → App Management → Manage Services on Server : Stop the Request Management Service

  • I managed to tackle this. Thanks Commented Oct 27, 2022 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.