Cross-Origin Resource Sharing (CORS) Requirements

By default, ArcGIS portals (including ArcGIS Online) allow cross-domain requests using Cross-Origin Resource Sharing (CORS).

If your portal has the default Organization | Settings | Security | Allow Origins settings, you do not need to do anything.

However, if both of the following are true, you must configure those settings and add the Access Control Designer as an allowed origin:

▪Access Control Designer is on a different domain than the portal.

▪You have modified the Organization | Settings | Security | Allow Origins settings from the defaults.

For details, see Restrict cross-domain requests to your portal.