KB-1011 401 error thrown when attempting to access Appian after configuring a web server

Elly Meng — Thu, 06 Jan 2022 22:27:36 GMT

Current Revision posted to Appian Knowledge Base by Elly Meng on 1/6/2022 10:27:36 PM

Symptoms

When attempting to access Appian with a web server configured, users receive a 401 error like the one below:

The following error is seen in the application server log:

ERROR com.appiancorp.security.cors.CorsFilter - CORS request rejected; invalid request from <SOURCE_IP_ADDRESS> to <URL>
javax.servlet.ServletException: CORS origin denied: <URL> is not on the allowed list:[] or the request path does not match the allowed paths.

Additionally, users who can login may be unable to load or open objects in /design.

Cause

There is a misconfiguration in custom.properties related to the site URL.

Action

Ensure the conf.suite.SCHEME property in custom.properties matches the appropriate scheme users are using to access the site. I.e., HTTPS if SSL is configured on the web server and HTTP if it is not.
Ensure the conf.suite.SERVER_AND_PORT property in custom.properties matches the computer’s hostname and includes a port only if the default port is not being used, which is 80 for HTTP and 443 for HTTPS. These default ports are assumed based on the value of conf.suite.SCHEME.

Affected Versions

This article applies to all self-managed versions of Appian using a web server.

Last Reviewed: January 2022

Tags: web browser, administration, third-party, web server

KB-1011 "CORS origin denied not on allowed list" error thrown when attempting to access Appian through a web server

Nick Vigilante — Thu, 09 Feb 2017 22:58:12 GMT

Revision 1 posted to Appian Knowledge Base by Nick Vigilante on 2/9/2017 10:58:12 PM

Symptoms

When attempting to access Appian, users may sometimes find their site or parts of their site not working due to rejected Cross Origin Resource Sharing (CORS) requests. When using Apache web server configured with SSL and JBoss, users may be shown a 401 error page whenever attempting to log in to their Appian site on Chrome. In some scenarios, popups may not show when attempting to open objects in the Designer interface (/designer). CORS requests can also be rejected if the SAML authentication is enabled but IdP is not added to the Appian CORS origin list.

Relevant errors found in the application server log following the main error are given below:

INFO  [stdout] (ajp-/0.0.0.0:8009-1) javax.servlet.ServletException: CORS origin denied mycomputer.mydomain.com not on allowed list:[]
INFO  [stdout] (ajp-/0.0.0.0:8009-1)   at com.appiancorp.security.cors.CorsFilter.handleNormalRequest(CorsFilter.java:258)
INFO  [stdout] (ajp-/0.0.0.0:8009-1)   at com.appiancorp.security.cors.CorsFilter.doFilter(CorsFilter.java:249)

Cause

Each web browser has its own implementation and security layer. At some point in the normal operation of the browser at which the context/domain changes, Chrome will detect the change as a security issue and will fail to display content. Other browsers do not have constraints as strict as this although any CORS enabled browser is capable of throwing this error given the appropriate conditions.

For more information about CORS, refer to Telerik's article on CORS.

Action

CORS request rejections most commonly occur due to improper configuration of the custom.properties file and CORS origins.

Check the custom.properties file and make sure the conf.suite.SCHEME line matches the appropriate scheme (HTTP if not using SSL/HTTPS if using SSL) and the conf.suite.SERVER_AND_PORT line matches the computer’s hostname and includes a port if not using port 80 for HTTP or port 443 for HTTPS.
Note: Do not add port 80 or port 443 to conf.suite.SERVER_AND_PORT as the port number is assumed to be either 80 or 443 based on the value of conf.suite.SCHEME.
Make sure all relevant origins are added to the Appian CORS origin list and any web server used must be configured to handle CORS requests.

Affected Versions

This article applies to all versions of Appian.

Last Reviewed: February 2017

Tags: web browser, embedded interfaces, administration, third-party