Relieving CORS error in AJAX requests from third-party sites

Objective:

To successfully make AJAX requests from a third-party site to a ServiceDesk Plus URL with custom headers without encountering CORS (Cross-Origin Resource Sharing) policy issues.

Initial AJAX Call Attempt:

The following AJAX call example demonstrates making a request using jQuery's $.ajax method:

Encountered Error:

The following CORS policy error may be encountered:

Access to XMLHttpRequest at 'https://your-servicedeskplus-url/api/v3/requests' from origin 'https://your-third-party-site' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Explanation of the Error:

CORS is a security feature implemented by web browsers to prevent web pages from making requests to a different domain than the one that served the web page. The error occurs because the server's response to the preflight request (an OPTIONS request sent by the browser to check permissions) does not include the necessary Access-Control-Allow-Origin header.

Resolution Steps:

To resolve this CORS issue, configure the ServiceDesk Plus applicataion to include the necessary CORS headers in its response. The steps are as follows:

Add Access-Control-Allow-Origin Header in Security Settings:

Go to the security settings of your ServiceDesk Plus application - > Advanced and add the Access-Control-Allow-Origin header with the value set to the origin of the request, e.g., https://your-third-party-site.

Add Access-Control-Allow-Headers Header in securitySettings.json:

Locate the securitySettings.json file in the [SDP_Home]/conf directory of your ServiceDesk Plus installation. Open the file and add the Access-Control-Allow-Headers header under the responseHeaders array. This header specifies which HTTP headers can be used during the actual request.

Update Access-Control-Allow-Headers in Security Settings:

Go to the security settings again and set the value of the Access-Control-Allow-Headers header to include the domain of your ServiceDesk Plus instance. For example if your ServiceDesk Plus domain is https://xyz.servicedeskplus.com, then the value of Access-Control-Allow-Headers header should be https://xyz.servicedeskplus.com

After updating the server configuration, retry the AJAX call. With the server correctly configured to allow cross-origin requests, the call should succeed without any CORS errors.

Summary:

By updating the ServiceDesk Plus server's security settings to include Access-Control-Allow-Origin and Access-Control-Allow-Headers headers, you can resolve CORS policy errors and enable successful cross-origin AJAX requests from any third-party site.