# Adding ALLOW\_CORS\_HEADER plugin in tutor

**URL:** <https://discuss.openedx.org/t/adding-allow-cors-header-plugin-in-tutor/10577>\
**Category:** Tutor Help\
**Tags:** tutor\
**Created:** [July 2, 2023, 5:08pm UTC](https://discuss.openedx.org/t/adding-allow-cors-header-plugin-in-tutor/10577 "2023-07-02T17:08:17Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![rediris](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/rediris/32/2097_2.png) [@rediris](https://discuss.openedx.org/u/rediris)\
**Post date:** [March 7, 2024, 4:57pm UTC](https://discuss.openedx.org/t/adding-allow-cors-header-plugin-in-tutor/10577/2 "2024-03-07T16:57:59Z")

</div>

@Xiao_Long I’ve had success with this by adding a tutor plugin. The only way I was able to get this to work is to have the custom site be the top level domain, and the LMS/CMS exist at a subdomain. The reason for this is the fact that a top level domain can access a subdomain’s cookies, but not the other way around. In my case, I have enabled the marketing site flag.

I’ve set the following in my `config.yml`:

```auto
FEATURES:
- ENABLE_MKTG_SITE: true
MARKETING_SITE_BASE_URL: your.domain
MARKETING_SITE_ROOT: https://your.domain
CMS_HOST: studio.lms.your.domain
LMS_HOST: lms.your.domain
PREVIEW_LMS_HOST: preview.lms.your.domain

```

An example of `my-plugin.py`:

```auto
from tutor import hooks

hooks.Filters.ENV_PATCHES.add_items([
(
"openedx-lms-common-settings",
f"""

CORS_ORIGIN_WHITELIST.append("https://your.domain")
CSRF_TRUSTED_ORIGINS.append("https://your.domain")
LOGIN_REDIRECT_WHITELIST.append("https://your.domain")

SESSION_COOKIE_DOMAIN="your.domain"
SHARED_COOKIE_DOMAIN = "your.domain"

""",
),
],
priority=hooks.priorities.LOW
)

```

I’ll add links below to other threads that go over similar requests:

- [Suggestions for solving the CORS & CSRF](https://discuss.openedx.org/t/suggestions-for-solving-the-cors-csrf/7471)
- [Enable CORS in tutor AWS AMI](https://discuss.openedx.org/t/enable-cors-in-tutor-aws-ami/11607)
- [CORS Issue with `frontend-app-learning` accessing LMS API endpoint](https://discuss.openedx.org/t/cors-issue-with-frontend-app-learning-accessing-lms-api-endpoint/6696)
- [Setting CORS\_ORIGIN\_ALLOW\_ALL - #6 by chintansanganis](https://discuss.openedx.org/t/setting-cors-origin-allow-all/11121/6)

---

_[View the full topic](https://discuss.openedx.org/t/adding-allow-cors-header-plugin-in-tutor/10577)._