# Where does the script for sessions go in the widget configuration?

**URL:** <https://devforum.okta.com/t/where-does-the-script-for-sessions-go-in-the-widget-configuration/830>\
**Category:** Questions\
**Tags:** widget, cors\
**Created:** [December 1, 2017, 5:33am UTC](https://devforum.okta.com/t/where-does-the-script-for-sessions-go-in-the-widget-configuration/830 "2017-12-01T05:33:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sobopla](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sobopla/32/207_2.png) [@sobopla](https://devforum.okta.com/u/sobopla)\
**Post date:** [December 1, 2017, 5:33am UTC](https://devforum.okta.com/t/where-does-the-script-for-sessions-go-in-the-widget-configuration/830/1 "2017-12-01T05:33:01Z")

</div>

I’m following the Okta Authentication Quickstart Guides, on Okta Sign-In Widget. It says to ‘copy this widget configuration into your front-end application:’ and gives a script. what is it referring to as the front-end? what file specifically will this go into? app.js? loginPage.js?

The script is not in the app yet. After attempting to sign in this error is givein  
`Failed to load https://dev-827074.oktapreview.com/api/v1/sessions/me: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access.`

---

<div class="post-metadata">

**Author:** ![tom](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/tom/32/24_2.png) [@tom](https://devforum.okta.com/u/tom)\
**Post date:** [December 1, 2017, 6:32pm UTC](https://devforum.okta.com/t/where-does-the-script-for-sessions-go-in-the-widget-configuration/830/2 "2017-12-01T18:32:48Z")

</div>

Make sure that you add `http://localhost:3000` as a trusted origin:

[https://developer.okta.com/docs/api/getting\_started/enabling\_cors.html#granting-cross-origin-access-to-websites](https://developer.okta.com/docs/api/getting_started/enabling_cors.html#granting-cross-origin-access-to-websites)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 12, 2024, 9:24pm UTC](https://devforum.okta.com/t/where-does-the-script-for-sessions-go-in-the-widget-configuration/830/3 "2024-01-12T21:24:39Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.