CORS for external actions

If external actions are hosted on a domain other than OpenText Software Delivery Management, use Cross-Origin Resource Sharing (CORS) to establish trust between the external domain and the OpenText Software Delivery Management server.

CORS prerequisites

  • Your external app is accessible to end users.

  • Network policy and firewalls allow access.

  • CORS parameters are configured correctly.

Required configuration

Enable and configure the following parameters:

Parameter Description
CORS_ENABLED Set to true to enable CORS.
CORS_ALLOW_ORIGIN Semicolon-separated list of domains allowed to make REST API calls to the server. Add your external action domain here.
CORS_SPACE_GLOBAL_ALLOW_ORIGIN Additional semicolon-separated list of domains allowed to make REST API calls. Values are combined with CORS_ALLOW_ORIGIN.
CORS_AUTH_ALLOW_ORIGIN Semicolon-separated list of domains allowed to make authentication requests to the server. Must include your external action domain.
CORS_MAX_AGE How long (in seconds) the results of a pre-flight request can be cached.
SAME_SITE_COOKIE_ATTRIBUTE Set to None to allow cookies in cross-site requests.

For details on configuring parameters, see Configuration parameters.

Send XSRF token in requests

OpenText Software Delivery Management protects against Cross-Site Request Forgery (CSRF) by requiring REST clients to provide the XSRF-HEADER header with a valid token value. When making requests from your external action to OpenText Software Delivery Management, you must obtain a valid XSRF token and include it in the request header. The XSRF token is passed to your external action via the xsrf_token URL parameter.

Configure the external action

Include {xsrf_token} in your external action URL:

Copy code 
{
  "name": "defect-details",
  "title": "Defect Details",
  "entity_type": [
    "defect"
  ],
  "views": [
    "list"
  ],
  "icon": "rss",
  "url": "http://corporate.domain.example?...&xsrf_token={xsrf_token}&..."
}

Include XSRF token in your requests:

Extract the xsrf_token from the URL query parameters and include it as the XSRF-HEADER in your fetch requests:

Copy code 
const xsrf = new URL(document.location.href).searchParams.get('xsrf_token');

await fetch(url, {
  headers: {
    "XSRF-HEADER": xsrf,
    "content-type": "application/json",
  },
  method: "PUT",
});