# SecurityAndCorsSettings

Location: [gRPC API](https://developer.m-files.com/APIs/gRPC-API/index.md) > [Reference](https://developer.m-files.com/APIs/gRPC-API/Reference/index.md) > [Messages](https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/index.md)

HTML version: https://developer.m-files.com/APIs/gRPC-API/Reference/Messages/MFiles.SecurityAndCorsSettings/

Struct for Web Cross origin Settings.

- **Full name:** `MFiles.SecurityAndCorsSettings`
- **Proto file:** [`mfiles/structs.proto`](https://developer.m-files.com/APIs/gRPC-API/downloads/proto/mfiles/structs.proto)

<a id="fields"></a>

## Fields

| Field | Type | Number | Description |
|---|---|---|---|
| <a id="f-enable_cross_origin_web_access"></a>`enable_cross_origin_web_access` | repeated `string` | 1 | The cross origin domain access for classic web. |
| <a id="f-cross_origin_headers"></a>`cross_origin_headers` | `string` | 2 | The allowed cross-origin Header like Content-Type, X-Authentication, Access-Control-Allow-Origin. |
| <a id="f-cross_origin_methods"></a>`cross_origin_methods` | `string` | 3 | the allowed cross-origin Methods like PUT,POST,DELETE,GET. |
| <a id="f-prevent_xfs"></a>`prevent_xfs` | `bool` | 4 | True to Prevent XFS, false to allow XFS. |
| <a id="f-allowed_cross_frame_sites"></a>`allowed_cross_frame_sites` | repeated `string` | 5 | The cross-frame sites access for classic web. |

<a id="used-by-methods"></a>

## Used by methods

- [IRPCLogin.GetClientSettingsByType](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/GetClientSettingsByType/index.md): Gets client settings (theme, timeouts, banners, web security settings) for an M-Files web, desktop or Outlook client.

<a id="used-in-fields"></a>

## Used in fields

- [`GetClientSettingsByTypeResponse.web_security_and_cors_settings`](https://developer.m-files.com/APIs/gRPC-API/Reference/MFiles.IRPCLogin/GetClientSettingsByType/index.md#response): The Web Access Cross origin settings.