Accessing Aras Innovator instance outside the network using Ngrok Tunneling

Hello Team,

I have installed Aras Innovator 2023 on Windows Server 2022 successfully. I can log in to the Innovator Instance using the localhost URL on the server and the hostname_server URL on the same network machine without any error. I am using the Ngrok Tunneling Client to forward the static domain to the local host to access the innovator Instance outside the network. While doing so, I am receiving an error that states "Error: Cannot access OAuth Server due to CORS policies". 

Below is the command used for Ngrok tunneling

cmd: ngrok --domain=xxx.yyy 80 --host-header=Access-Control-Allow-Origin

where xxx.yyy is the static domain name

Also, I have modified the below-given line in the <customHeaders> section of ...\Innovator\Server\web.config.

WAS: <add name="Access-Control-Allow-Origin" value="*" />

IS: <add name="Access-Control-Allow-Origin" value="https://xxx.yyy" />

Finally, I followed the below steps to solve the issue which didn't help though. [Reference: https://github.com/ArasLabs/aras-workflow-approval/issues/1]

The following steps will also avoid the CORS error:

  1. Open the IIS Manager.
  2. Select your Aras Innovator instance from the site list in the Connections pane.
  3. In the center pane, select HTTP Response Headers from the IIS section.
  4. In the Actions pane on the right, select Add…
  5. Add a header with the following values:
    • Name: Access-Control-Allow-Headers
    • Value: database, authpassword, authuser, soapaction, content-type
  6. Click Add… again and add another header with the following values:
    • Name: Access-Control-Allow-Origin
    • Value: https domain to whitelist or *

Ngrok Log:

Client Error:

Note: The above approach is for testing purposes only.

Parents Reply
  •   

    After I replacing the "web.config" from my backup (i.e. Just replaced "innovator.site" with my ngrok website in the OOTB web.config file), I am able to access the ARAS innovator outside the network without any issue.

    Notably, I appreciate your finding on https & http conflict with the Ngrok tunnelling.

    RCA: Missing of "Content-Security-Policy" header with value "update-insecure-requests" under IIS 

Children
No Data