---
title: CORS configuration
---

Cross-Origin Resource Sharing (CORS) controls which origins can make requests to Deephaven services. You may need to configure CORS when:

- Your environment uses DNS aliases that resolve to the same host.
- You embed the Web IDE in another application.
- You use an identity-aware proxy such as [Google Cloud IAP](../kubernetes/kubernetes-iap-integration.md).

## Web API Server CORS

The `web_api_service` serves the Web IDE and handles client connections. Set the following properties in [`iris-environment.prop`](../ops-guide/configuration-files.md#edit-iris-environmentprop) to configure CORS for the Web API Server:

| Property              | Description                                                                                                                                                      | Default                                                           |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
| `cors.allowedOrigins` | Comma-separated list of allowed origins. With Envoy, CORS is disabled when unset. Without Envoy, the server derives a default origin from the Web API host/port. | With Envoy: disabled. Without Envoy: `https://{host}:{port}`      |
| `cors.allowedMethods` | Comma-separated list of allowed HTTP methods.                                                                                                                    | The server's configured method set                                |
| `cors.allowedHeaders` | Comma-separated list of allowed request headers.                                                                                                                 | Headers required for gRPC, gRPC-web, and Deephaven authentication |

To configure:

```bash
/usr/illumon/latest/bin/dhconfig properties export --directory /tmp iris-environment.prop
```

Add or update the CORS properties:

```properties
cors.allowedOrigins=https://deephaven-prod.example.com:8000,https://infra-host-01.example.com:8000
```

Import the configuration and restart the web API service:

```bash
sudo -u irisadmin /usr/illumon/latest/bin/dhconfig properties import /tmp/iris-environment.prop
sudo -u irisadmin /usr/illumon/latest/bin/dh_monit restart web_api_service
```

> [!NOTE]
> The `cors.allowedOrigins` value must include the full origin — protocol, hostname, and port if non-standard. For example: `https://example.com:8443`.

## ACL Editor CORS

The ACL Editor web UI communicates with the `db_acl_write_server` REST API, which runs as a standalone service. By default, Deephaven configures CORS to allow requests only from the web application running on the same host.

If your environment uses DNS aliases (e.g., `deephaven-prod.example.com` pointing to `infra-host-01.example.com`), users accessing the web UI via the alias will encounter CORS errors when attempting to edit ACLs. Configure the `DbAclWriteServer.acl.origin` property to include all valid origins:

```properties
DbAclWriteServer.acl.origin=https://deephaven-prod.example.com:8000,https://infra-host-01.example.com:8000
```

After updating [`iris-environment.prop`](../ops-guide/configuration-files.md#edit-iris-environmentprop), restart the ACL write server:

```bash
sudo -u irisadmin /usr/illumon/latest/bin/dh_monit restart db_acl_write_server
```

> [!NOTE]
> The port is typically `8000` for deployments with Envoy and `8123` for deployments without Envoy.

> [!CAUTION]
> Do not use wildcard (`*`) origins in production environments. Always specify explicit origins.

## Related documentation

- [Configuring Envoy](../envoy/configuring-envoy.md#cross-origin-resource-sharing-cors)
- [Google Cloud IAP integration](../kubernetes/kubernetes-iap-integration.md)
- [Configuration files](../ops-guide/configuration-files.md)