- Getting started
- Best practices
- Tenant
- About the Tenant Context
- Searching for Resources in a Tenant
- Managing Robots
- Connecting Robots to Orchestrator
- Storing Robot Credentials in CyberArk
- Storing Unattended Robot Passwords in Azure Key Vault (read only)
- Storing Unattended Robot Credentials in HashiCorp Vault (read only)
- Storing Unattended Robot Credentials in AWS Secrets Manager (read only)
- Deleting Disconnected and Unresponsive Unattended Sessions
- Robot Authentication
- Robot Authentication With Client Credentials
- SmartCard Authentication
- Configuring automation capabilities
- Audit
- Settings - Tenant Level
- Resource Catalog Service
- Folders Context
- Automations
- Processes
- Jobs
- Triggers
- Logs
- Monitoring
- Queues
- Assets
- Storage Buckets
- CORS/CSP Configuration
- Managing Storage Buckets
- Moving Bucket Data Between Storage Providers
- Test Suite - Orchestrator
- Other Configurations
- Integrations
- Host administration
- Organization administration
- Troubleshooting
CORS/CSP Configuration
Web browser access to Amazon and Azure storage buckets can sometimes be restricted due to Cross Origin Resource Sharing (CORS) and Content Security Policy (CSP) settings.
This applies to Orchestrator buckets as well, when Orchestrator's storage is configured to use Azure or Amazon.
The following operations are impaired when accessing bucket content from the Orchestrator UI:
- Uploading files into a storage bucket
- Downloading files from a storage bucket.
-
Opening document validation actions or form actions that use images stored in buckets.
Note: Accessing storage files using activities is not impacted by CORS and CSP policies because they are browser-specific and are validated/enforced at browser level only.
Both CORS and CSP allow whitelisting identified entities in the web application. See below details about each.
CORS is a mechanism that allows resources on a web page to be accessed across domain boundaries.
Orchestrator web browser access to Amazon and Azure storage buckets can be restricted due to same-origin-policy on the provider side. Successfully accessing the content of such a bucket from the Orchestrator UI requires you to configure the respective provider to allow cross-origin requests from Orchestrator.
If you change the frontend DNS, you must update the CORS settings of all storage buckets (S3 or compatible), or on all Azure storage accounts that Orchestrator accesses.
GET and PUT requests from Orchestrator. For example:
[
{
"AllowedHeaders": [
"*"
],
"AllowedMethods": [
"GET",
"PUT"
],
"AllowedOrigins": [
"https://your.orchestrator.dns.name"
],
"ExposeHeaders": []
}
][
{
"AllowedHeaders": [
"*"
],
"AllowedMethods": [
"GET",
"PUT"
],
"AllowedOrigins": [
"https://your.orchestrator.dns.name"
],
"ExposeHeaders": []
}
]Enable GET and PUT operations for requests originating from the Orchestrator. For example:
<Cors>
<CorsRule>
<AllowedOrigins>http://your.orchestrator.dns.name</AllowedOrigins>
<AllowedMethods>PUT,GET</AllowedMethods>
<AllowedHeaders>*</AllowedHeaders>
<ExposedHeaders>*</ExposedHeaders>
</CorsRule>
</Cors><Cors>
<CorsRule>
<AllowedOrigins>http://your.orchestrator.dns.name</AllowedOrigins>
<AllowedMethods>PUT,GET</AllowedMethods>
<AllowedHeaders>*</AllowedHeaders>
<ExposedHeaders>*</ExposedHeaders>
</CorsRule>
</Cors>Content Security Policy is a web browser security layer that prevents a web app from making requests outside a trusted set of hosts.
When using storage buckets, Orchestrator automatically allows calls to Azure or Amazon S3, if these providers are enabled or if Orchestrator's composite storage is configured to use Azure or Amazon S3.
To fix possible CSP issues, add the Buckets.ContentSecurityPolicy app setting and set its value to a comma-separated list of all domains to be allowed. This parameter overrides the corresponding Orchestrator settings in regards to Azure and AWS, so make sure to adds Azure and/or AWS as well, if needed.
