# Remove CORS from \_cmsinternal **URL:** \ **Category:** Experience Manager (PaaS/OnPrem)\ **Created:** [April 21, 2020, 3:03pm UTC](https://community.bloomreach.com/t/remove-cors-from-cmsinternal/1886 "2020-04-21T15:03:58Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Yves\_Viegen](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/yves_viegen/32/66_2.png) [@Yves\_Viegen](https://community.bloomreach.com/u/Yves_Viegen)\ **Post date:** [April 21, 2020, 3:03pm UTC](https://community.bloomreach.com/t/remove-cors-from-cmsinternal/1886/1 "2020-04-21T15:03:58Z")
For debugging purposes we would like to call the [https://test-clientname.onehippo.com/site/\_cmsinternal/resourceapi](https://test-clientname.onehippo.com/site/_cmsinternal/resourceapi) from a local frontend project. This gives CORS related issues. Below the hst:clientname/hst:hosts configuration On the hst:root (primary hst:mount) we have configured the response headers: hst:responseheaders Access-Control-Allow-Origin: \* Access-Control-Allow-Credentials: true Apparently this doesn’t apply to \_cmsinternal. Any suggestions/clues/tips? Thank you. ---
**Author:** ![bcanvural](https://yyz1.discourse-cdn.com/flex027/user_avatar/community.bloomreach.com/bcanvural/32/235_2.png) [@bcanvural](https://community.bloomreach.com/u/bcanvural)\ **Post date:** [April 24, 2020, 2:40pm UTC](https://community.bloomreach.com/t/remove-cors-from-cmsinternal/1886/2 "2020-04-24T14:40:23Z")
That endpoint is added to the site mount dynamically i believe. I don’t think it’s meant to be accessed outside with a cors request. (perhaps other people can elaborate on this) Maybe it’s an option to create a specific “preview” mount. If you create a mount with hst:type=preview > **[Detect Preview or Channel Manager Request Context - Bloomreach Experience -...](https://documentation.bloomreach.com/14/library/concepts/channels/jsp-code-to-find-out-whether-a-request-is-a-preview-or-cms-request.html)** > > Open Source Enterprise Content Management