Security

Splunk Rest Request using browser - Unauthorized because of Origin header

Explorer

"services/search/jobs/" Splunk endpoint is replying “Unauthorized” (HTTP 401) due to the presence of the “Origin”/”Referer” parameter in the header request.
To best integrate the browser/client all to Splunk, can we allow all or specific origin header or remove this restriction?

it works fine for doing it with a linux curl. But even by adding the “Origin” header parameter and it won’t work.
Basically, for using the front-end, we need the splunk endpoint to allow the origin header from a specific or all orginis.

0 Karma
1 Solution

Explorer

In Server.conf change the parameter below to * to enable all the connections please check the details in the following link

https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Serverconf

crossOriginSharingPolicy = ...
* List of the HTTP Origins for which to return Access-Control-Allow-* (CORS)
headers.
* These headers tell browsers that web applications are trusted at those sites
to make requests to the REST interface.
* The origin is passed as a URL without a path component (for example
"https://app.example.com:8000").
* This setting can take a list of acceptable origins, separated
by spaces and/or commas.
* Each origin can also contain wildcards for any part. Examples:
://app.example.com: (either HTTP or HTTPS on any port)
https://.example.com (any host under example.com, including
example.com itself)
* An address can be prefixed with a '!' to negate the match, with
the first matching origin taking precedence. For example,
"!
://evil.example.com:* ://.example.com:" to not avoid
matching one host in a domain
* A single "
" can also be used to match all origins
* No default.

View solution in original post

0 Karma

Explorer

In Server.conf change the parameter below to * to enable all the connections please check the details in the following link

https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Serverconf

crossOriginSharingPolicy = ...
* List of the HTTP Origins for which to return Access-Control-Allow-* (CORS)
headers.
* These headers tell browsers that web applications are trusted at those sites
to make requests to the REST interface.
* The origin is passed as a URL without a path component (for example
"https://app.example.com:8000").
* This setting can take a list of acceptable origins, separated
by spaces and/or commas.
* Each origin can also contain wildcards for any part. Examples:
://app.example.com: (either HTTP or HTTPS on any port)
https://.example.com (any host under example.com, including
example.com itself)
* An address can be prefixed with a '!' to negate the match, with
the first matching origin taking precedence. For example,
"!
://evil.example.com:* ://.example.com:" to not avoid
matching one host in a domain
* A single "
" can also be used to match all origins
* No default.

View solution in original post

0 Karma