CORS

**Security Audit Mechanism: Cross-Origin Allowance**

In order to enhance security measures, we have introduced a setting for a cross-origin allow list to restrict client access sources. By default, if the cross-origin allow list is not configured, all clients are permitted to access the interface. Once the cross-origin allow list is set, only clients specified in the list can access.

### Setting the Cross-Origin Allow List

1. Open the `\larkxr-center\application.properties` file, locate `pxy.security.access-control-allow-origin=`, and set it to: `pxy.security.access-control-allow-origin=http://192.168.0.55:8181`

- Note the format: `protocol://domain or IP:port`

### Example Illustration

- Example Scenario: Unable to access the admin page correctly via `http://192.168.0.28:8059`

![](https://docs.paraverse.cc/media/202504/3583960351bb4e75a4269de40ee94b605547.png)

- When setting `pxy.security.access-control-allow-origin=http://192.168.0.55:8181,http://192.168.0.28:8059`, adding `http://192.168.0.28:8059` to the cross-origin allow list (multiple entries separated by commas), and restarting the `admin` service, accessing `http://192.168.0.28:8059` will allow correct page access.

![](https://docs.paraverse.cc/media/202504/743ba28a5abd4123a06d76c8b95d7b4e8002.png)