Requests sent through a web server, reverse proxy, or load balancer that does not have any restriction of hosts allowed to make CORS requests will appear to be allowed from hosts denied in ArcGIS Server's AllowedOrigins. You will need to configure the web server, reverse proxy, or load balancer to follow the same restrictions as your ArcGIS Server site.
- Open the ArcGIS Server Administrator Directory and log in with a user that has administrative access to the server. The URL is formatted https://gisserver.domain.com:6443/arcgis/admin.
- Click system > handlers > rest > servicesdirectory.
- On the Services Directory page, click edit.
- In the AllowedOrigins field, specify a comma-separated list of machines and their domain names that are allowed to access your web services, for example, https://machine.esri.com, http://host.arcgis.com, https://gisserver.example.com.
Use of the * wildcard character as a substitute for the machine name is not supported. You must specify the fully qualified domain name of the machine in the list.
- Click Save.