Skip to main content
 

How can we help?

Search

Enable CORS

  • Updated

If your writers use a web application like Google Docs, it might be necessary to enable Cross-Origin Resource Sharing (CORS). You enable CORS so that your Acrolinx Platform and the web application server can share resources. If you're a Standard Stack user, you can do this by adding a property to your configuration file.

Note

If you're using Standard Stack for the first time, the built-in default CORS settings are active if you don't add your own settings to the overlay. These built-in settings let you connect to the following integrations: Firefox, Chrome, Microsoft Office, and XMetaL.

To enable CORS on your Acrolinx Platform, follow these steps:

  1. Open the core server properties file.

  2. Add the following property:

    cors.allowedOrigins=[HOST_SERVER_ADDRESS]

    For example, if you host your web application at the address https://demo-inc.com, you would enter the property as follows:

    Example:

    cors.allowedOrigins= https://demo-inc.com

    Some applications require specific values. Below is a list of specific examples that depend on the application you're using:

    Application

    CORS Property

    Chrome*

    		 
    cors.allowedOrigins=chrome-extension://pgenbnkcpmebbcoeeekefkmblmblppbj

    Allow access from Acrolinx for Chrome. The ID belongs to the Acrolinx extension in Chrome and shouldn't change.

    Figma

    		 
    CORS.allowedOrigins=null

    Allow access from Acrolinx for Figma.

    Firefox*

    		 
    cors.allowedOrigins=moz-extension://*

    Allow access from any Firefox extension. Because of a limitation in Firefox that adds a unique ID to each user instance, we can't set it to only allow the Acrolinx extension.

    Google Docs and Google Sheets

    Check your CORS Origin in the About tab of your Sidebar.

    If you can't access the Sidebar, you can allow access from any Google extension by using:

    cors.allowedOrigins=*.googleusercontent.com

    Microsoft Edge

    Microsoft Edge Based on Chromium

    If you use Microsoft Edge based on Chromium (version 80 or later), add the following CORS value:

    Microsoft Edge based on Chromium (80 or later)

    cors.allowedOrigins=chrome-extension://pkpofneijhldmnimmimdpnmknlhjgemj

    Allow access from Acrolinx for Microsoft Edge. The ID belongs to the Acrolinx extension in Microsoft Edge and shouldn't change.

    Note

    Microsoft Edge based on Chromium requires Acrolinx for Microsoft Edge 1.4 or later.

    Older Versions of Microsoft Edge

    If you use a non-Chromium-based version of Microsoft Edge (version 44 or earlier), add the following CORS value:

    Non-Chromium-based Microsoft Edge (44 or earlier)

    cors.allowedOrigins=ms-browser-extension://*

    Allow access from any Microsoft Edge extension. Because of a limitation in Microsoft Edge that adds a unique ID to each user instance, we can't set it to only allow the Acrolinx extension.

    Microsoft Office*

    Acrolinx for Office on Windows version 1.6 and later

    cors.allowedOrigins=https://extensions.acrolinx.cloud

    Acrolinx for Office on Windows version 1.5.x and earlier

    cors.allowedOrigins=res://*

    Allow access from Microsoft Office.

    Microsoft 365 Word

    		 
    cors.allowedOrigins=https://updates.acrolinx.com

    Allow access from Microsoft 365.

    Visual Studio Code

    Note

    Setting CORS is only necessary if you use Acrolinx for Visual Studio Code version 1.1 or above.

    The CORS value for Visual Studio Code depends on your version of Visual Studio Code.

    Visual Studio Code versions 1.47 and above

    cors.allowedOrigins=vscode-webview://*

    Visual Studio Code versions 1.46 and below

    cors.allowedOrigins=null

    WordPress

    		 
    cors.allowedOrigins=<APPLICATION_SERVER_ADDRESS>

    Replace <APPLICATION_SERVER_ADDRESS> with the address where you host your WordPress instance. For example, if you host WordPress at https://demo-inc.com, you would enter the property as follows:

    Example

    cors.allowedOrigins=https://demo-inc.com

    XMetaL

    		 
    cors.allowedOrigins=file://127.0.0.1

    Allow access from your local file system. Even though XMetaL isn't a web application, it uses Internet Explorer to load the Sidebar.

    Custom or third-party integrations

    1. Open the Sidebar in your custom integration.

    2. Navigate to About.

    3. Copy the CORS Origin link.

    4. Add the link to the cors.allowedOrigins property.

    *Included in the built-in default settings for Standard Stack instances.

  3. If you'd like to add multiple origins, you can add all of them to one CORS property and separate them with a comma. Here's an example of how to add multiple origins to allow Firefox and Chrome at the same time:

    Example

    cors.allowedOrigins=moz-extension://*,chrome-extension://pgenbnkcpmebbcoeeekefkmblmblppbj

    If you're still having trouble signing in to Acrolinx from the Sidebar, try enabling CORS from any source. To do this, add the property as follows:

    cors.allowedOrigins=*

    Note

    We recommend that you only use this setting for temporary testing. Allowing CORS from any source could make your server vulnerable to malicious activity.

  4. Save your changes and restart the Acrolinx Platform.

Disable CORS

If you want to limit access to your API endpoints, you can disable all of your CORS settings. To do so, set the property cors.allowedOrigins= to no value in your coreserver.properties file. For example:

cors.allowedOrigins=

Be sure to specify a value for cors.allowedOrigins=. If you leave this blank, Acrolinx will apply the built-in CORS settings by default.