Cross-Origin Resource Sharing CORS is a mechanism that uses additional HTTP headers to tell a browser to let a web application running at one origin (domain) have permission to access selected resources from a server with a different origin. A web application performs a cross-origin HTTP request when it requests a resource of an origin (domain, protocol or port) different from its own origin. This is a general insight into CORS
For the service calls that are triggered from a client rendered UI, one can secure the sales configuration service by setting allowed CORS domains. The allowed CORS domains for service calls is set in the Administration UI. By default no domain is allowed, Only the domains set in the Administration UI will be allowed. Multiple domains can be set as comma separated values.
In addition to the standard headers that are supported, the implemented CORS handling of the Sales Configuration service allows:
-
If-Match
-
If-None-Match
-
Cookie
-
X-CorrelationID
The service exposes the headers:
Scenarios with the CORS domain
If the Origin does not match the maintained Origin in the CORS setting, the service will return error status 403 Forbidden and body Invalid CORS request.
If the given HTTP method is not among the allowed methods (other than GET, DELETE, POST, PUT and PATCH) error 403 Forbidden is returned.
If the Origin matches the maintained Origin, service returns valid response.