Share this page

# CORS for external actions

If external actions are hosted on a domain other than OpenText Software Delivery Management, use Cross-Origin Resource Sharing (CORS) to establish trust between the external domain and the OpenText Software Delivery Management server.

In this topic:

## CORS prerequisites

- Your external app is accessible to end users.

- Network policy and firewalls allow access.

- CORS parameters are configured correctly.

## Required configuration

Enable and configure the following parameters:

Parameter | Description
--- | ---
CORS_ENABLED | Set to true to enable CORS.
CORS_ALLOW_ORIGIN | Semicolon-separated list of domains allowed to make REST API calls to the server. Add your external action domain here.
CORS_SPACE_GLOBAL_ALLOW_ORIGIN | Additional semicolon-separated list of domains allowed to make REST API calls. Values are combined with CORS_ALLOW_ORIGIN.
CORS_AUTH_ALLOW_ORIGIN | Semicolon-separated list of domains allowed to make authentication requests to the server. Must include your external action domain.
CORS_MAX_AGE | How long (in seconds) the results of a pre-flight request can be cached.
SAME_SITE_COOKIE_ATTRIBUTE | Set to None to allow cookies in cross-site requests.

For details on configuring parameters, see Configuration parameters.

## Send XSRF token in requests

OpenText Software Delivery Management protects against Cross-Site Request Forgery (CSRF) by requiring REST clients to provide the `XSRF-HEADER` header with a valid token value. When making requests from your external action to OpenText Software Delivery Management, you must obtain a valid XSRF token and include it in the request header. The XSRF token is passed to your external action via the `xsrf_token` URL parameter.

### Configure the external action

Include `{xsrf_token}` in your external action URL:

Copy code

    {
      "name": "defect-details",
      "title": "Defect Details",
      "entity_type": [
        "defect"
      ],
      "views": [
        "list"
      ],
      "icon": "rss",
      "url": "http://corporate.domain.example?...&xsrf_token={xsrf_token}&..."
    }

### Include XSRF token in your requests:

Extract the `xsrf_token` from the URL query parameters and include it as the `XSRF-HEADER` in your fetch requests:

Copy code

    const xsrf = new URL(document.location.href).searchParams.get('xsrf_token');

    await fetch(url, {
      headers: {
        "XSRF-HEADER": xsrf,
        "content-type": "application/json",
      },
      method: "PUT",
    });

https://admhelp.microfocus.com Software Delivery Management 8942
Tips to improve your search results... OpenText™ Software Delivery Management Help Center OpenText™ Software Delivery Management Help 26.3 All View Local Help Center View Online Help Center Version: