Skip to content
Access control › Hardening settings › Platform Security
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Restrict JSONP Requests to Trusted URLs [Updated in Security Center 1.3]

Specify trusted URLs for the AngularJS $http service to allow or reject JSONP requests.

Increase security on your instance by ensuring that only trusted URLs for the AngularJS $http service can allow/reject JSONP requests. JSONP requests are allowed to any URL if these properties are not configured and enabled.

Use the value of the angular.jsonp.inclusion_list.urls system property to define a list of URLs that are trusted and allow for this purpose. Set the value of the angular.jsonp.inclusion_list.enabled system property to true to limit allowed JSONP to only the URLs listed in angular.jsonp.inclusion_list.urls.

More information

AttributeDescription
Configuration nameangular.jsonp.inclusion_list.enabled
Configuration typeSystem Properties \(/sys\_properties\_list.do\)
Data typeBoolean
Recommended valuetrue
Default valuetrue
CategoryAccess control
Security risk
  • Severity score: Medium
  • CVSS score: 5.4
  • Security risk details: Setting this property to false enables JSONP requests to any URL.
Dependencies and prerequisitesNone

Parent Topic:Access control