---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Specify URL allow list for cross-origin iframe communication

# Specify URL allow list for cross-origin iframe communication {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use a system property to specify which domains you trust for cross-origin communication.
Use the glide.ui.concourse.onmessage_enforce_same_origin_whitelist property to enable cross-origin communication between iframes from trusted domains you specify in an inclusion list. This property specifies
list of trusted origins for message propagation (sent via window.postMessage) in the UI. If this property isn't set to a list of trusted/allowed origins for cross domain messaging, then cross origin messages can be allowed from
domains which contain malicious scripts. The property values should contain a list of origins should be separated by a comma. If the property value is empty then all domains are blocked.

Ensure that the glide.ui.concourse.onmessage_enforce_same_origin_whitelist system property contains only a list of trusted domains to be used for cross origin messaging. If the list is empty no domains are
allowed.

## More information {#sc-specify-url-allow-list-for-cross-origin-iframe-communication__section_wc1_cqn_phc}

{#sc-specify-url-allow-list-for-cross-origin-iframe-communication__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.concourse.onmessage_enforce_same_origin_whitelist |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | a comma separated list of trusted domains or empty |
| Default value | empty |
| Fallback value | empty |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: Invalid trusted origins can allow untrusted domains to inject malicious payloads via window.postMessage, leading to cross-origin attacks such as data exfiltration, session hijacking, UI manipulation or DOM based XSS. If a web page contains event handlers that do not perform proper origin validation, a web page, or script from any origin, can communicate with it. It can also initiate any functionality performed by the event handler. Communication with iframes from other domains is a security risk. {#sc-specify-url-allow-list-for-cross-origin-iframe-communication__ul_g1g_3sf_xwb} |
| Functional impact | If you don't add intended domains to the inclusion list, cross-origin messages from that domain are not allowed. |
| Dependencies and prerequisites | None |
[ ]

{#sc-specify-url-allow-list-for-cross-origin-iframe-communication__table_ajc_b43_3kb}