Requests sent through a web server, reverse proxy, or load balancer that does not have any restriction of hosts allowed to make CORS requests appear to be allowed from hosts denied by the AllowedOrigins property. You must configure the web server, reverse proxy, or load balancer to follow the same restrictions as your ArcGIS Server site.
- Open the ArcGIS Server Administrator Directory and log in with a user that has administrative access to the server. The URL is formatted https://gisserver.domain.com:6443/arcgis/admin.
- Click system > handlers > rest > servicesdirectory.
- On the Services Directory page, click edit.
- In the AllowedOrigins field, specify a comma-separated list of machines and their domain names that are allowed to access your web services, for example, https://machine.esri.com, http://host.arcgis.com, https://gisserver.example.com.
You cannot use the * wildcard character in the domain name as a substitute for the machine name, such as https://*.example.com. You must specify the fully qualified domain name of each machine in the list.
- Click Save.