Cors Prevent Chatbot Einstein Bot to Load

Question

My team developing chatbot using Einstein bot for our website.

Currently we cannot load the chatbot except in salesforce preview page.

When we try to run chatbot inside our website, it will not loads and generate javascript error related to CORS.

Here the error message:

Access to fetch at 'https://blabla123-utfslcommunity.cs76.force.com/tes/embeddedService/sidebarApp.app?aura.format=JSON&aura.formatAdapter=LIGHTNING_OUT&guestUserLang=en-US&eswConfigDeveloperName=Chat_One' from origin 'https://localhost:44369' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

The error looks simple, but I have tried many way but still fail.

I have at least 2 attemp, all not working.

1. using web.config

<system.webServer>
  <httpProtocol>
      <customHeaders>
         <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
         <add name="Access-Control-Allow-Origin" value="https://blabla123-utfslcommunity.cs76.force.com"/>
          <add name="Access-Control-Allow-Methods" value="GET,PUT,POST,DELETE,OPTIONS"/>
          <add name="Access-Control-Allow-Headers" value="Content-Type"/>
      </customHeaders>
  </httpProtocol>
</system.webServer>

2. in controller

public ActionResult Index()
    {
ControllerContext.HttpContext.Response.Headers.Add("Access-Control-Allow-Origin", "https://utdev-utfslcommunity.cs76.force.com");
        ControllerContext.HttpContext.Response.Headers.Add("Access-Control-Allow-Origin", "https://d.la1-c1cs-ukb.salesforceliveagent.com");
        ControllerContext.HttpContext.Response.Headers.Add("Access-Control-Allow-Origin", "https://service.force.com");
        ControllerContext.HttpContext.Response.Headers.Add("Access-Control-Allow-Origin", "*");

I think what we do is to set CORS value for whenever our website accessed by salesforce, not the other way around.

I have add our site in SF whitelist, but still this CORS problem not gone.

Edit : problem solved. I am not really sure what changes that make the problem gone.

There are 5 teams in my company that related to salesforce. My development team only handle the Einstein chatbot.

Looks like what has been done by other team make fix the CORS problem.