---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Allow CORS origins for OAuth endpoints

# Allow CORS origins for OAuth endpoints {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use a system property to configure to specify which domains are allowed to make cross-origin requests.
ServiceNow can function as an OAuth authorization server, a resource server, or both simultaneously. When browser-based applications must access ServiceNow's OAuth endpoints, such as the authorization server metadata, protected resource metadata, or token endpoint, the browser's same-origin policy blocks these cross-origin requests by default.
Configure the Access-Control-Allow-Origin header for these endpoints to specify which domains are allowed to make cross-origin requests.  
References:

* [OAuth Authorization Server Metadata RFC](https://datatracker.ietf.org/doc/html/rfc8414)
* [OAuth Protected Resource Metadata RFC](https://datatracker.ietf.org/doc/html/rfc9728)
{#sc-allow-cors-origins-for-oauth-endpoints__ul_z3g_l4k_xhc}

When integrating third-party solutions with ServiceNow OAuth functionality, ensure that the glide.oauth.cors.allowed.origin system property exists in the system properties \[sys_properties\] table, and holds the
external domain(s) required for Cross Origin Resource Sharing (CORS) functionality.

## More information {#sc-allow-cors-origins-for-oauth-endpoints__section_b4x_14k_xhc}

{#sc-allow-cors-origins-for-oauth-endpoints__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.oauth.cors.allowed.origin |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | Varies based on use case. This property can one of these values: 1. An empty string 2. A single hostname 3. An asterisk (\*), which allows all origins to access the OAuth endpoints. {#sc-allow-cors-origins-for-oauth-endpoints__ol_sd2_x4k_xhc} Tip: There's no dynamic list for allow-listing multiple hostnames. Use an asterisk(\*) to access the OAuth endpoints from multiple domains. |
| Default value | empty string |
| Fallback value | empty string |
| Category | [Configuration](https://www.servicenow.com/docs/6g9V8~pRg55o7Q9NVpD4uQ "The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.") |
| Security risk | * Severity score: 3.5 * CVSS score: Low * Security risk details: A third party applications inability to interact with the ServiceNow platform due to browsers' single origin policy may cause a denial of service. {#sc-allow-cors-origins-for-oauth-endpoints__ul_g1g_3sf_xwb} |
| Functional impact | This property can be used to connect MCP clients to the instance when the client exists entirely in the browser, and does not make token or discovery calls via a backend call to the ServiceNow platform. |
| Dependencies and prerequisites | None |
[ ]

{#sc-allow-cors-origins-for-oauth-endpoints__table_ajc_b43_3kb}