Fall 2023: Enhanced CORS Policy for Service Desk integrations

In the Fall 2023 release of Oomnitza, we’ve enhanced our Cross-Origin Resource Sharing (CORS) policy. CORS is a browser security feature that allows web pages from one domain to access resources from another domain. Oomnitza's Service Desk integrations use CORS for direct browser-to-server communications.

We’ve introduced a new global variable security.allowed_cors_domainsthat allows you to build a list of trusted domains in your Oomnitza instance. This enhancement improves the security of your Service Desk integrations and ensures that they are protected from unauthorized access.

Important
This enhancement applies only to Service Desk integrations. As an opt-in feature, your existing integrations won't be affected. However, once you add any domain to the global variable, your Oomnitza instance will rely on this allow list. Ensure all necessary domains are added.

Procedure

To leverage this enhanced security feature, add the domains of your service desk integrations to the security.allowed_cors_domainsglobal variable in Oomnitza:

• Identify the domains of your service desk integrations
• Add the domains in a comma-separated list as values to the security.allowed_cors_domains global variable. Refer to the steps in Update Global Setting for more information.

Identify the domains 

Service desk integration	Domain
Salesforce	Follows the format: MyDomainName--PackageName.container.force.com If your installed package is unmanaged, the Package Name is c If your URL is https://mycompany.my.salesforce.comthe value would be mycompany--c.container.force.com  You do not need to include the leadinghttps://. Refer to Retrieving your domain for more information
Freshservice	For Freshservice, you need to add this specific domain without the leadinghttps://: d3h0owdjgzys62.cloudfront.net Freshservice support forum
Jira Cloud	Enter the following value:jira-plugin-server.oomnitza.com
Jira Server	Enter the domain of your Jira Server instance, without the https:// prefix: For example, mycompany.domain.com
ServiceNow	Enter the domain of your ServiceNow instance, without thehttps:// prefix: For example, mycompany.service-now.com
Zendesk	Typically follows the format ID.apps.zdusercontent.com You do not need to include the leadinghttps://.  Refer to Retrieving your domain for more information

Retrieving your domain

If you're having trouble identifying the correct domain, you can find it in the "Referer" parameter in your browser.

1. Launch the third-party application and go to the page displaying the Oomnitza widget.
2. Right-click and choose Inspect to open your browser's developer tools
3. Click on the Network tab.
4. Refresh the page to capture the latest data.
5. Search for a request directed to the Oomnitza server, such as "session-check".
6. Look for the "Referer" parameter under the Request Header.

Fig: Zendesk Referer parameter.

Update the Global Setting

To add the domain of your service desk integrations as a global setting, follow these steps:

1. Click Configuration > General > Global Settings.
2. Search for the global setting security.allowed_cors_domains global variable. If you're on Fall 2023 release or newer, this will be readily available. For instances prior to Fall 2023, you can add this global variable manually and take advantage of the same benefits.
3. Enter the domains of your service desk integrations as the value. Ensure that the domains are provided in a comma-separated list with no spaces.
4. Click Save.

Conclusion

The improvements to our CORS policy through the introduction of a global variable is a valuable security feature that can help to protect your Service Desk integrations. We encourage you to take advantage of this new feature and add all of your domains to the trusted allow list.

Related Links

 Global security settings