glide.oauth.cors.allowed.origin The glide.oauth.cors.allowed.origin property specifies the value for the Access-Control-Allow-Origin header in OAuth-related requests. Admins should review this setting to ensure proper CORS configuration for browser-based clients connecting to the instance.
The answers below summarize the purpose, scope, default effect, and review scenarios for this property.
| What does it do? | This property defines the allowed origin for CORS requests related to OAuth token and metadata endpoints, facilitating secure communication between browser clients and the ServiceNow instance. |
|---|---|
| What area does it affect? | OAuth and CORS configuration |
| What does the default mean? | No default value is documented in this property record. |
| When should you review it? | Review this property when configuring OAuth for browser-based applications or troubleshooting CORS issues. |
Raw metadata from the property record.
| Property name | glide.oauth.cors.allowed.origin |
|---|---|
| Sys ID | 60f2b0b6ff313210ffb4ffffffffff64 |
| Type | string |
| Application | Global |
| Default value | Not set |
| Description | The value to serve in the Access-Control-Allow-Origin header for well-known authorization server metadata, well-known protected resource metadata endpoints, and OAuth token endpoint on glide. This can be used to connect MCP clients to the instance when the client exists entirely in the browser and does not make token or discovery calls via a backend call to the instance. |
| Updated | 2025-12-17 01:41:41 |
Official references and nearby text excerpts where this property appears.
glide.oauthOther properties in the same namespace.
glide.oauth.allow.parameters.in.post.body.only
This property enforces the use of POST body parameters exclusively for OAuth token requests, enhancing securit
glide.oauth.enable.jwt.requester_id
This property determines whether the requester ID is considered when generating JWT tokens, affecting the secu
glide.oauth.enforce_restricted_binding_for_ui
This property controls the enforcement of restricted binding for UI interactions, impacting how OAuth tokens a
glide.oauth.entity_profile_denylist
This property defines which oauth_entity_profiles prevent admins from viewing the 'Token received' field, enha
glide.oauth.inbound.ropc.grant_type.disabled
This property controls whether the resource owner password credentials grant type is allowed for inbound OAuth
glide.oauth.integration_registry.oob_clients
This property defines a string of sys_ids representing the default out-of-box OAuth clients in ServiceNow.
glide.oauth.oidc.blacklisted_metadata_urls
This property allows administrators to define a list of OIDC metadata URLs that enforce the use of 'email' as
glide.oauth.oidc.provision.email_claim
This property defines the source field for the email claim used in OAuth-OIDC automatic user provisioning, lin