# What is the purpose of Settings -\> Security -\> CORS origins vs similar environment setting?

**URL:** https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331
**Category:** Support
**Created:** [07.Ноябрь.2015 12:58:36 UTC](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331 "2015-11-07T12:58:36Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ckamps](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@ckamps](https://meta.discourse.org/u/ckamps)
#### Post date: [07.Ноябрь.2015 12:58:36 UTC](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331/1 "2015-11-07T12:58:36Z")

</div>

What is the purpose of Settings → Security → CORS origins

![](https://global.discourse-cdn.com/meta/original/3X/c/3/c38f3dd9ed29377b6a5d18871ecdae88c17ab43d.png)

As compared to the `CORS_ORIGIN` setting in `app.yml`

```
  ## Enable Cross-origin resource sharing so that SSO works properly
  DISCOURSE_ENABLE_CORS: true
  DISCOURSE_CORS_ORIGIN: '*'

```

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [08.Ноябрь.2015 00:46:38 UTC](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331/2 "2015-11-08T00:46:38Z")

</div>

Not sure, @neil can you elaborate?

---

<div class="post-metadata">

### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil)
#### Post date: [09.Ноябрь.2015 15:48:38 UTC](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331/3 "2015-11-09T15:48:38Z")

</div>

In a multisite setup, like our hosting, each site can have its own allowed origins by using the “cors origins” setting. Setting DISCOURSE\_CORS\_ORIGIN in app.yml will be global to all sites, which probably isn’t what you want in multisite. If you only have one site in a container, then using DISCOURSE\_CORS\_ORIGIN and “cors origins” will be the same.

---

<div class="post-metadata">

### Author: ![neil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/neil/32/102150_2.png) [@neil](https://meta.discourse.org/u/neil)
#### Post date: [19.Ноябрь.2015 16:27:12 UTC](https://meta.discourse.org/t/what-is-the-purpose-of-settings-security-cors-origins-vs-similar-environment-setting/35331/4 "2015-11-19T16:27:12Z")

</div>