Splunk Rest Request using browser - Unauthorized because of Origin header

[mibrahim8]

"services/search/jobs/" Splunk endpoint is replying “Unauthorized” (HTTP 401) due to the presence of the “Origin”/”Referer” parameter in the header request.
To best integrate the browser/client all to Splunk, can we allow all or specific origin header or remove this restriction?

it works fine for doing it with a linux curl. But even by adding the “Origin” header parameter and it won’t work.
Basically, for using the front-end, we need the splunk endpoint to allow the origin header from a specific or all orginis.

[mibrahim8 · Accepted solution]

In Server.conf change the parameter below to * to enable all the connections please check the details in the following link

https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Serverconf

crossOriginSharingPolicy = ...
* List of the HTTP Origins for which to return Access-Control-Allow-* (CORS)
headers.
* These headers tell browsers that web applications are trusted at those sites
to make requests to the REST interface.
* The origin is passed as a URL without a path component (for example
"https://app.example.com:8000").
* This setting can take a list of acceptable origins, separated
by spaces and/or commas.
* Each origin can also contain wildcards for any part. Examples:
://app.example.com: (either HTTP or HTTPS on any port)
https://.example.com (any host under example.com, including
example.com itself)
* An address can be prefixed with a '!' to negate the match, with
the first matching origin taking precedence. For example,
"!://evil.example.com:* ://.example.com:" to not avoid
matching one host in a domain
* A single "" can also be used to match all origins
* No default.