CORS for external actions

If external actions are hosted on a domain other than OpenText Core Software Delivery Platform, use Cross-Origin Resource Sharing (CORS) to establish trust between the external domain and the OpenText Core Software Delivery Platform server.

In this topic:

CORS prerequisites

• Your external app is accessible to end users.

• Network policy and firewalls allow access.

• CORS parameters are configured correctly.

Required configuration

Enable and configure the following parameters:

To enable CORS for your external action:

1. Set CORS_ALLOW_ORIGIN to the domain(s) of your external action.
2. Contact support to add your external action domain to CORS_AUTH_ALLOW_ORIGIN. Without this, authentication requests from your external action are blocked.

For details on configuring parameters, see Configuration parameters.

Send XSRF token in requests

OpenText Core Software Delivery Platform protects against Cross-Site Request Forgery (CSRF) by requiring REST clients to provide the XSRF-HEADER header with a valid token value. When making requests from your external action to OpenText Core Software Delivery Platform, you must obtain a valid XSRF token and include it in the request header. The XSRF token is passed to your external action via the xsrf_token URL parameter.

Configure the external action

Include {xsrf_token} in your external action URL:

{
  "name": "defect-details",
  "title": "Defect Details",
  "entity_type": [
    "defect"
  ],
  "views": [
    "list"
  ],
  "icon": "rss",
  "url": "http://corporate.domain.example?...&xsrf_token={xsrf_token}&..."
}

Include XSRF token in your requests:

Extract the xsrf_token from the URL query parameters and include it as the XSRF-HEADER in your fetch requests:

const xsrf = new URL(document.location.href).searchParams.get('xsrf_token');

await fetch(url, {
  headers: {
    "XSRF-HEADER": xsrf,
    "content-type": "application/json",
  },
  method: "PUT",
});