# CORS Reference Learn about FusionAuth and Cross-Origin Resource Sharing (CORS) configuration. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) [Cross-Origin Resources Sharing](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) (CORS) provides a mechanism to control permission to resources on a server on a different domain or origin than the originating request. Practically, this means that in order to make HTTP requests in JavaScript to FusionAuth when the request is coming from a different domain, CORS needs to be configured to allow the request. Most of the time this works as designed, you do not need to think much about CORS configuration. In some cases you may find the configuration is restricting the way you want to use FusionAuth, especially if you are building out browser-based single page applications (SPAs). If this happens, FusionAuth allows you to modify or enable the CORS filter. ## Configuration Available since `1.8.0` To modify the default CORS configuration navigate to Settings -> System -> CORS . Please utilize caution when modifying this configuration, with great power comes great responsibility. These settings apply to every Tenant and Application in the instance. You can't configure CORS per Tenant or per Application, so list the origins of all your browser applications here. ![CORS Configuration](https://fusionauth.io/img/docs/screenshots/operate-cors-settings.png) ### Form Fields `Enable CORS` When enabled, the CORS filter will process requests made to FusionAuth. The default setting disables the CORS filter, and all CORS requests will be denied. `Include credentials in CORS requests` The `Access-Control-Allow-Credentials` response header values as described by [MDN Access-Control-Allow-Credentials](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials). `Allowed headers` The `Access-Control-Allow-Headers` response header values as described by [MDN Access-Control-Allow-Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers). `Allowed methods` The `Access-Control-Allow-Methods` response header values as described by [MDN Access-Control-Allow-Methods](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods). `Allowed origins` The `Access-Control-Allow-Origin` response header values as described by [MDN Access-Control-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin). If the wildcard `*` is specified, no additional domains may be specified. Avoid `*` in production. It lets JavaScript on any website call FusionAuth from your users' browsers. `Exposed headers` The `Access-Control-Expose-Headers` response header values as described by [MDN Access-Control-Expose-Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers). `Preflight max age` The `Access-Control-Max-Age` response header values as described by [MDN Access-Control-Max-Age](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age). `Log blocked CORS requests` * Available since `1.25.0` Creates event log entries to help debug requests blocked by the CORS filter. Check System -> Event Log . When enabled, a Debug event log will be created when the FusionAuth CORS filter returns a `403` detailing the reason for the response to assist you in configuration. ### CORS Excluded URI Paths We have excluded some paths from FusionAuth CORS filtering in order to force same-origin browser requests on these paths. The following are the URL patterns excluded from our CORS filter. * `/account*` * `/admin*` * `/support*` * `/ajax*` ## Default Configuration The following reference has been provided in case you want to return the CORS filter configuration to the original values provided by FusionAuth. ### Default Configuration `Enable CORS` `false`, but you need this to be `true` to process any CORS requests. `Include credentials in CORS requests` `false` `Allowed headers` `Accept`, `Access-Control-Request-Headers`, `Access-Control-Request-Method`, `Authorization`, `Content-Type`, `Last-Modified`, `Origin`, `X-FusionAuth-TenantId`, `X-Requested-With` `Allowed methods` * `GET` * `OPTIONS` `Allowed origins` None `Exposed headers` * `Access-Control-Allow-Origin` * `Access-Control-Allow-Credentials` `Preflight max age` `1800` Related [APIs Configure CORS How to set up and use the FusionAuth API Explorer. corscross-origin resource sharingcors configuration](https://fusionauth.io/docs/apis/configure-cors.md) [Deploy Harden a FusionAuth Production Instance Learn which settings to change to secure a FusionAuth instance before it goes into production. security](https://fusionauth.io/docs/deploy/harden/harden-a-production-instance.md) [Deploy Secure a FusionAuth Instance Learn how to secure the network, database, and configuration of a self-hosted FusionAuth instance. security](https://fusionauth.io/docs/deploy/harden.md) [Migrate Password-Hashing Algorithms This is a reference for all of the current password hashing algorithms support by FusionAuth out of the box. security](https://fusionauth.io/docs/migrate/password-hashes/algorithms.md) --- ## Other pages in Clients > For the full index of this section, see [Security](https://fusionauth.io/docs/llms-security.txt). - [CIMD Security](https://fusionauth.io/docs/security/clients/cimd-security.md): Learn how FusionAuth protects itself when it fetches a Client ID Metadata Document from a URL a third party controls.