title: Why am I receiving a cross-origin error when using the react-stormpath LoginForm component?
body: <p>I followed the instructions found in the readme in the <a href="https://github.com/stormpath/stormpath-sdk-react#stormpath-react-sdk" rel="nofollow noreferrer">stormapth-sdk-react github respository</a> to set up a basic login form. The form displays, but I am immediately greeted by errors in the console:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load https://{redacted}.apps.stormpath.io/me. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' is therefore not allowed access. The response had HTTP status code 403.</p>
  </blockquote>
  
  <p>I get an identical error for the login endpoint.</p>
  
  <p>The <a href="https://docs.stormpath.com/client-api/product-guide/latest/configuration.html" rel="nofollow noreferrer">Client API Guide</a> indicates that client endpoints have to be configured to allow traffic from a particular domain, but does not provide any instructions for how to do this:</p>
  
  <blockquote>
    <p>Applications that use the Client API have two relevant configuration parameters, both found on your Application’s page in the Stormpath Admin Console:...</p>
    
    <ol>
    <li><strong>Authorized Callback URIs:</strong> This list should include any URIs that your users will be returned to after they have completed authentication with an outside provider, for example as a part of the social login flow. For example, if you do not specify a redirect URI when you kick off the social login flow, the user will be redirected the first URI in this list. </li>
    <li><strong>Authorized Origin URIs:</strong> <strong>This list should include the application’s URL, or whatever URL will be included in the Origin header of requests sent to the Client API.</strong></li>
    </ol>
  </blockquote>
  
  <p>What do I need to do to get this working?</p>