Overview

This page explains how to control which origins may read session-protected CMS resources cross-origin. It applies to resources served by org.onehippo.cms7.utilities.servlet.SecureCmsResourceServlet with the cmsSecure init-param set to true.

When to Use

Configure the CORS origin allowlist when you need to:

• Let an external frontend application on a different origin load Experience Manager resources that require an authenticated CMS session.

• Restore credentialed cross-origin access after upgrading to version 17.3, if your project registers SecureCmsResourceServlet with cmsSecure=true.

Most projects do not need this configuration. The default web.xml registers the servlet with cmsSecure=false, and public resources are not affected by the allowlist.

Background

SecureCmsResourceServlet serves Experience Manager resources such as JavaScript, CSS, and font files from JAR files. It can add CORS response headers so that a page on another origin can load these resources. How it does so depends on the cmsSecure init-param:

• Public resources (cmsSecure=false, the default): Any request origin is reflected in Access-Control-Allow-Origin. Access-Control-Allow-Credentials is never set, because there is no session-bound data to protect.

• Secure resources (cmsSecure=true): The request origin is reflected, together with Access-Control-Allow-Credentials: true, only if the origin is on the allowlist. Requests from any other origin receive the resource without CORS headers, so the browser blocks the cross-origin read.

Vary: Origin is set on every response in both modes.

Version Note:

• In version 17.2 and earlier, a cmsSecure=true servlet reflected any request origin together with Access-Control-Allow-Credentials: true.

• Starting with version 17.3, no origin is allowed unless you configure the allowlist. This closes a cross-origin read of session-bound responses (CWE-942).

Allowlist Configuration

Set the Java system property brxm.cms.allowed-cors-origins to a comma-separated list of exact origins:

-Dbrxm.cms.allowed-cors-origins=https://app.example.com,https://other.example.com:8443

The allowlist is a system property rather than a web.xml init-param because trusted origins differ per environment, while the same distribution is promoted unchanged from test to acceptance to production.

Each entry must be an exact origin of the form scheme://host[:port]:

• Matching is case-insensitive and compares scheme, host, and port as a whole. Partial matches are never accepted, so https://app.example.com.evil.com does not match https://app.example.com.

• The default port of the scheme is ignored: https://app.example.com:443 and https://app.example.com are the same origin. Any other port is significant.

• Wildcards are not supported.

• A comma is the only separator. Whitespace around an entry is ignored.

Entries that are not exact origins are ignored and logged at WARN level at startup. This includes entries with a trailing slash, a path, a query string, a fragment, user information, a bare hostname without scheme, the wildcard *, and the opaque origin null.

Important:
The property is read once when the servlet initializes. After adding, changing, or removing an origin, restart the application, or redeploy it on Bloomreach Cloud.

Bloomreach Cloud

On Bloomreach Cloud, add the property to a configuration file and select use as Java system properties when you deploy the distribution. See Set Environment Configuration Properties.

brxm.cms.allowed-cors-origins=https://app.example.com,https://other.example.com

Note:
Selecting the file alone is not sufficient. Without the use as Java system properties option, its entries never become system properties and the allowlist stays empty. You also cannot overwrite an uploaded configuration file: uploading a file with the same name creates a copy with a suffix, such as cors (1).properties. Select the new file when you redeploy.

Verify the Configuration

At startup, the servlet logs one INFO line stating the origins it allows, for example:

Allowing credentialed cross-origin reads of cmsSecure servlet 'SecureResourceServlet' from [https://app.example.com]

If no allowlist is configured, the servlet logs that it allows no cross-origin reads and names the Bloomreach Cloud option to check. Requests from an origin that is not on the allowlist are logged at DEBUG level for the org.onehippo.cms7.utilities.servlet.SecureCmsResourceServlet logger.

Removing an Origin

Removing an origin from the allowlist stops new credentialed cross-origin reads after the restart or redeploy. Browsers and shared caches may keep serving already cached responses, including their CORS headers, to that origin until the cache entry expires. Resource responses are cached for up to one year by default. Take this into account when you remove an origin you no longer control.