CORS Policy Configuration for 1C-Bitrix API

We often encounter a situation where a frontend application at app.example.com makes requests to an API at api.example.com (or to Bitrix24 REST methods), and the browser blocks the request due to CORS. Classic pain: a developer spends hours searching for the error, even though the problem is solved by adding three headers. CORS configuration is not about protecting the server (server-side requests are unaffected by CORS), but about allowing your JavaScript to work with cross-origin requests. Over 10 years of working with Bitrix, we have solved CORS problems for 200+ projects, saving clients an average of $200–400 on debugging.

How CORS Requests Work

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that blocks requests to a domain different from the page domain. Simple requests (GET, POST with Content-Type: application/x-www-form-urlencoded) are sent directly by the browser, but it checks the response: if there is no Access-Control-Allow-Origin header with the correct value, JavaScript does not receive the response (the request was sent, the server responded, but the browser hid it from JS). Preflight requests are for non-standard methods (PUT, DELETE, PATCH) and headers (Authorization, Content-Type: application/json). The browser first sends an OPTIONS request (“Can I do this?”), the server responds—and only then the browser sends the actual request.

When Is a Preflight Request Needed?

Any request with a Content-Type other than application/x-www-form-urlencoded, such as application/json, or with a custom header (e.g., X-API-Key) triggers a preflight. Preflight also occurs when using methods other than GET/POST. This feature is important to consider when designing a REST API—if your client sends JSON, be ready to handle OPTIONS.

How to Configure CORS on Nginx

For an on-premise Bitrix API, CORS is best configured in Nginx, not PHP. Nginx handles OPTIONS preflight without starting PHP, giving a performance gain of up to 15 ms per request.

location /api/ { # List of allowed origins set $cors_origin ""; if ($http_origin ~* "^https://(app\.example\.com|admin\.example\.com)$") { set $cors_origin $http_origin; } # Preflight OPTIONS if ($request_method = OPTIONS) { add_header Access-Control-Allow-Origin $cors_origin always; add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, PATCH, OPTIONS" always; add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-API-Key" always; add_header Access-Control-Max-Age 3600 always; add_header Content-Length 0; return 204; } add_header Access-Control-Allow-Origin $cors_origin always; add_header Access-Control-Allow-Credentials true always; proxy_pass http://php_backend; } 

Access-Control-Allow-Credentials: true is needed if requests carry cookies (Bitrix sessions). In this case, Access-Control-Allow-Origin cannot be *—only a specific domain.

Configuration via PHP (init.php or middleware)

If CORS needs to be configured dynamically (different rules for different endpoints, origin list from DB):

// /local/php_interface/init.php or API middleware $allowedOrigins = ['https://app.example.com', 'https://admin.example.com']; $origin = $_SERVER['HTTP_ORIGIN'] ?? ''; if (in_array($origin, $allowedOrigins)) { header('Access-Control-Allow-Origin: ' . $origin); header('Access-Control-Allow-Credentials: true'); header('Vary: Origin'); // Important for proper CDN caching } if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS'); header('Access-Control-Allow-Headers: Authorization, Content-Type, X-API-Key'); header('Access-Control-Max-Age: 3600'); http_response_code(204); exit; } 

The Vary: Origin header is mandatory with dynamic CORS—MDN Web Docs recommend it for proper CDN caching.

CORS for Bitrix24 REST API

Cloud Bitrix24 cannot be configured—CORS headers are managed on the Bitrix side. For browser requests to portal.bitrix24.ru/rest/, use the built-in JS-SDK (BX24.callMethod), which works inside an iframe application and is not subject to CORS restrictions. Direct REST requests from the browser to a different Bitrix24 domain require proxying through your server. More details in the official documentation.

Why Can't You Use * with Credentials?

Access-Control-Allow-Origin: * allows everyone. But with Access-Control-Allow-Credentials: true, this is not allowed—the browser will block such a response. Only specific domains are permitted.

Validate the origin list. A check like if ($origin === 'https://app.example.com') is not bypassed by an attacker with header Origin: https://app.example.com. No—this is not a bypass: CORS protects against browser attacks, not against curl. Server-side requests ignore CORS.

Preflight cache (Max-Age). A value of 3600 means the browser does not send a repeated OPTIONS request for one hour. A too large value slows down detection of CORS policy changes.

Typical Scenarios Requiring CORS Configuration

How to Resolve Common CORS Errors

What's Included in the Work

• Audit of current CORS configuration and problem identification—95% of issues are identified within 30 minutes.
• CORS setup on Nginx or Apache (depending on the environment).
• Implementation of dynamic CORS via PHP (if required).
• Development of a proxy server for Bitrix24 REST (if necessary).
• Testing of all scenarios (simple, preflight, with credentials)—an average of 8 test cases.
• Documentation and recommendations for ongoing support.

How to Configure CORS: Step-by-Step Guide

1. Determine the list of allowed origins.
2. Choose the configuration method: Nginx (static) or PHP (dynamic).
3. Add handling of OPTIONS requests with the required headers.
4. Set Access-Control-Allow-Credentials: true for requests with sessions.
5. Test via curl or browser developer tools.

Configuring CORS is 30 minutes of work with a proper understanding of the mechanism. Most CORS problems are solved by correct header placement (before outputting the response body) and proper handling of OPTIONS requests. If you want to avoid hours of debugging, entrust this task to professionals. Contact us to get a consultation for your project. We guarantee that after configuration, your API will work correctly with any browser clients.