When the Swifty chatbot tries to fetch popular questions from a customer’s KB (e.g., /popular_questions.json), the request fails with a CORS error in the browser. However, this is not due to missing CORS headers on our end (If the user set the allowed origin successfully). Instead, it’s caused by the customer’s SSO configuration, which redirects unauthenticated users to their Microsoft login page (302 redirect). Since the response is HTML (login form) instead of JSON, and lacks the expected CORS headers, the browser blocks it. Root Cause: The /popular_questions.json endpoint is behind SSO protection. The embedded script runs on unauthenticated sessions, triggering an automatic redirect to Microsoft SSO. This redirect leads to a CORS error due to the unexpected response type and missing headers.