Restrict allowed domains for cross-origin iframe communication
Use a system property to enable cross-origin communication between iframes.
Use the glide.ui.concourse.onmessage_enforce_same_origin property to prevent cross-origin communication from untrusted domains. If not set to the recommended value of true then validation is not performed for cross-origin messaging. If set to true then domains listed in the glide.ui.concourse.onmessage_enforce_same_origin_whitelist system property can propagate messages in the UI. Use glide.ui.concourse.onmessage_enforce_same_origin_whitelist to control which domains are allowed.
Ensure that the glide.ui.concourse.onmessage_enforce_same_origin property exists in the System Properties [sys_properties] table and is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.ui.concourse.onmessage_enforce_same_origin |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | Access control |
| Security risk | - Severity score: 4.2 - CVSS score: Medium - Security risk details: If a web page's event handlers don't perform proper origin validation, then another web page or script from any origin can communicate with it. These pages or scripts can also initiate any functionality performed by the event handler. This property allows potentially untrusted external domains to send messages to the ServiceNow instance, increasing the risk of cross-origin attacks like data theft or UI manipulation. |
| Functional impact | If you don't add intended domains to the inclusion list in the glide.ui.concourse.onmessage_enforce_same_origin_whitelist system property, cross-origin messages from that domain aren't allowed. |
| Dependencies and prerequisites | None |
Parent Topic:Access control