CORS configuration
Cross-Origin Resource Sharing (CORS) controls which origins can make requests to Deephaven services. You may need to configure CORS when:
- Your environment uses DNS aliases that resolve to the same host.
- You embed the Web IDE in another application.
- You use an identity-aware proxy such as Google Cloud IAP.
Web API Server CORS
The web_api_service serves the Web IDE and handles client connections. Set the following properties in iris-environment.prop to configure CORS for the Web API Server:
| Property | Description | Default |
|---|---|---|
cors.allowedOrigins | Comma-separated list of allowed origins. With Envoy, CORS is disabled when unset. Without Envoy, the server derives a default origin from the Web API host/port. | With Envoy: disabled. Without Envoy: https://{host}:{port} |
cors.allowedMethods | Comma-separated list of allowed HTTP methods. | The server's configured method set |
cors.allowedHeaders | Comma-separated list of allowed request headers. | Headers required for gRPC, gRPC-web, and Deephaven authentication |
To configure:
Add or update the CORS properties:
Import the configuration and restart the web API service:
Note
The cors.allowedOrigins value must include the full origin — protocol, hostname, and port if non-standard. For example: https://example.com:8443.
ACL Editor CORS
The ACL Editor web UI communicates with the db_acl_write_server REST API, which runs as a standalone service. By default, Deephaven configures CORS to allow requests only from the web application running on the same host.
If your environment uses DNS aliases (e.g., deephaven-prod.example.com pointing to infra-host-01.example.com), users accessing the web UI via the alias will encounter CORS errors when attempting to edit ACLs. Configure the DbAclWriteServer.acl.origin property to include all valid origins:
After updating iris-environment.prop, restart the ACL write server:
Note
The port is typically 8000 for deployments with Envoy and 8123 for deployments without Envoy.
Caution
Do not use wildcard (*) origins in production environments. Always specify explicit origins.