> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arc.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cross-Origin Resource Sharing (CORS)

> Configure CORS for the CData Arc Admin API to allow browser-based clients to connect.

export const CommonCors = () => <>
    <table>
      <thead>
        <tr><th>Setting</th><th>Description</th></tr>
      </thead>
      <tbody>
        <tr>
          <td><strong>Enable cross-origin resource sharing (CORS)</strong></td>
          <td>Whether or not CORS is enabled. The rest of these options are only available when you check this box.</td>
        </tr>
        <tr>
          <td><strong>Allow all domains without '*'</strong></td>
          <td>If enabled, domain origins are not restricted to a specific list.</td>
        </tr>
        <tr>
          <td><strong>Access-Control-Allow-Origin</strong></td>
          <td>The comma-delimited list of domain origins to allow. Included as an HTTP response header.</td>
        </tr>
        <tr>
          <td><strong>Access-Control-Allow-Credentials</strong></td>
          <td>Whether or not user credentials such as cookies are allowed in cross-origin requests. Included as an HTTP response header.</td>
        </tr>
        <tr>
          <td><strong>Access-Control-Allow-Methods</strong></td>
          <td>The comma-delimited list of methods to allow. Included as an HTTP response header.</td>
        </tr>
        <tr>
          <td><strong>Access-Control-Allow-Headers</strong></td>
          <td>The comma-delimited list of headers to allow. Included as an HTTP response header.</td>
        </tr>
        <tr>
          <td><strong>Access-Control-Max-Age</strong></td>
          <td>The maximum duration (in seconds) that Access-Control response header values can be cached.</td>
        </tr>
      </tbody>
    </table>
  </>;

export const siteNameShort = "Arc";

You can configure cross-origin resource sharing (CORS) for the Admin API by navigating to the [Admin API](./admin-api) portion of the [Security tab](../getting-started/administration/settings/security). CORS allows browser-based clients to connect to {siteNameShort}. Without CORS, browser-based scripts cannot connect to {siteNameShort} because of the same-origin policy enforced by the browser. This policy restricts client-side scripts and documents from loading resources outside their origin. The origin of a script consists of the protocol, host, and port.

<CommonCors />