---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Allow CORS Origins for OAuth Endpoints

# Allow CORS Origins for OAuth Endpoints {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use a system property to configure to specify which domains are allowed to make cross-origin requests.
ServiceNow can function as an OAuth authorization server, a resource server, or both simultaneously. When browser-based applications must access ServiceNow's OAuth endpoints, such as the authorization server metadata, protected resource metadata, or token endpoint, the browser's same-origin policy blocks these cross-origin requests by default.
Configure the Access-Control-Allow-Origin header for these endpoints to specify which domains are allowed to make cross-origin requests.  
References:

* [OAuth Authorization Server Metadata RFC](https://datatracker.ietf.org/doc/html/rfc8414)
* [OAuth Protected Resource Metadata RFC](https://datatracker.ietf.org/doc/html/rfc9728)
{#sc-allow-cors-origins-for-oauth-endpoints__ul_z3g_l4k_xhc}

When integrating third-party solutions with ServiceNow OAuth functionality, ensure that the glide.oauth.cors.allowed.origin system property exists in the System Properties \[sys_properties\] table, and holds the
external domain(s) required for Cross Origin Resource Sharing (CORS) functionality.

## More information {#sc-allow-cors-origins-for-oauth-endpoints__section_b4x_14k_xhc}

{#sc-allow-cors-origins-for-oauth-endpoints__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.oauth.cors.allowed.origin |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | Varies based on use case. This property can one of these values: 1. An empty string 2. A single hostname 3. An asterisk (\*), which allows all origins to access the OAuth endpoints. {#sc-allow-cors-origins-for-oauth-endpoints__ol_sd2_x4k_xhc} Tipp: There's no dynamic list for allow-listing multiple hostnames. Use an asterisk(\*) to access the OAuth endpoints from multiple domains. |
| Default value | empty string |
| Fallback value | empty string |
| Category | [Configuration](https://servicenow-prod.fluidtopics.net/s9Iz8esR6282THUNXoEpzg "The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.") |
| Security risk | * Severity score: 3.5 * CVSS score: Low * Security risk details: A third party applications inability to interact with the ServiceNow platform due to browsers' single origin policy may cause a denial of service. {#sc-allow-cors-origins-for-oauth-endpoints__ul_g1g_3sf_xwb} |
| Functional impact | This property can be used to connect MCP clients to the instance when the client exists entirely in the browser, and does not make token or discovery calls via a backend call to the ServiceNow platform. |
| Dependencies and prerequisites | None |
[ ]

{#sc-allow-cors-origins-for-oauth-endpoints__table_ajc_b43_3kb}