CORS allowlisting

CORS origin configuration specifies which browser-based web application origins are permitted to access the back-end API through cross-origin requests. This must be configured with the identity of the front-end web application so that you can allow supported browsers to permit the application to access the API. CORS is enforced by the browser and is not, by itself, an authentication or authorization mechanism for preventing all other clients from accessing the API.

The CORS allowlist defined in CorsSetting.json is intended to support browser-based access to Historian’s REST data APIs from approved web origins. It is not recommended for desktop-style applications, where there is no browser security boundary to enforce. For desktop development scenarios—including local tooling or embedded web views—the Historian SDK is the supported integration approach, as it avoids browser CORS constraints and aligns with the intended authentication and authorization model.