Content Security Policy -- Blocking PRPushServlet
Application is updated with Content Security Policy Name as pxDefaultSecured. Since then we are seeing the below CORS log entries in browser network log related to PRPushServlet.
Access to XMLHttpRequest at 'https://www.myorg.se/' (redirected from 'https://appl.sit.myorgtest.se/prweb/PRPushServlet/app/myApp_/!@72e53abd75c91ff07c6cfbab325ae949!?PZSRVRPSH=true&portalName=Applicant&clientID=CXtwZH1BQUFBQnQyQXhrS2FjLytwdDNKWGNaRU41WmtOczk2VWxNRGpwVWNWM1d4Tkd6RTkrM2xWTlJ5V0xzdGo2YTNPNFFMUjN3PT0%3D&X-Atmosphere-tracking-id=0&X-Atmosphere-Framework=3.1.3-javascript&X-Atmosphere-Transport=long-polling&X-Atmosphere-TrackMessageSize=true&Content-Type=application%2Fjson&X-atmo-protocol=true&_=1696362649869') from origin 'https://appl.sit.myorgtest.se' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
Updated: 4 Oct 2023 10:12 EDT
Pegasystems Inc.
GB
The error "No 'Access-Control-Allow-Origin' header is present on the requested resource" occurs when a web application tries to access resources from a different domain, and the server hosting the resources does not include the 'Access-Control-Allow-Origin' header in its response. This is due to the browser's same-origin policy, which restricts web pages from making requests to a different domain than the one that served the web page.
In the context of a Content Security Policy named pxDefaultSecured, this error can occur if the policy does not include the necessary CORS (Cross-Origin Resource Sharing) settings.
To resolve this issue, you can update the CORS settings in your Pega application by following these steps:
- In your Service-REST rule, go to the Authorization headers/request tab.
- Add the following lines to set the appropriate CORS headers:
response.setHeader("Access-Control-Allow-Origin", "*"); response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE,PUT"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization");
The error "No 'Access-Control-Allow-Origin' header is present on the requested resource" occurs when a web application tries to access resources from a different domain, and the server hosting the resources does not include the 'Access-Control-Allow-Origin' header in its response. This is due to the browser's same-origin policy, which restricts web pages from making requests to a different domain than the one that served the web page.
In the context of a Content Security Policy named pxDefaultSecured, this error can occur if the policy does not include the necessary CORS (Cross-Origin Resource Sharing) settings.
To resolve this issue, you can update the CORS settings in your Pega application by following these steps:
- In your Service-REST rule, go to the Authorization headers/request tab.
- Add the following lines to set the appropriate CORS headers:
response.setHeader("Access-Control-Allow-Origin", "*"); response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE,PUT"); response.setHeader("Access-Control-Max-Age", "3600"); response.setHeader("Access-Control-Allow-Headers", "Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization");
By updating the CORS settings, you can allow your web application to access the resources from a different domain without encountering the "No 'Access-Control-Allow-Origin' header is present on the requested resource" error.
This answer came from a Pega gen-AI assistant using the below references. As a Support Center moderator, I reviewed the answer and references for accuracy:
CORS header 'Access-Control-Allow-Origin' missing > Chunk 0
PRPC62sp2 : Observing security issue while launching in Pega App in firefox > Chunk 0
CORS- Pre-Flight Requests Failing > Chunk 0
If you still need help please log a support incident via the MSP.