Skip to main content
Announcements
Qlik Connect 2025: 3 days of full immersion in data, analytics, and AI. May 13-15 | Orlando, FL: Learn More
cancel
Showing results for 
Search instead for 
Did you mean: 
Yoshidata
Partner - Contributor II
Partner - Contributor II

has been blocked by CORS policy: Request header field x-qlik-xrfkey

Hi All,

we are migrating a mashup from the enterprise version to the SaaS version of Qlik

however the Graphics that are generated by ODAG give error
The message appears
"Dynamic Charts are not enabled"

when looking at the browser console, I get the following message
"has been blocked by CORS policy: Request header field x-qlik-xrfkey"

Does anyone know how I can fix this?

I am afraid that I have to change some connection parameter in js but I am not sure where to do this

 

 

 

 

 

connect();

async function connect() {
    const urlQlikServer = "https://saas.us.qlikcloud.com";
    const urlLoggedIn = "/api/v1/audits";//Use GET request to see if you are authenticated
    const urlLogin = "/login";
    const webIntegrationId = 'mykeywebintegration';        

    //Check to see if logged in
    return await fetch(`${urlQlikServer}${urlLoggedIn}`, {
        credentials: 'include',
        headers: {                  
            'Qlik-Web-Integration-ID':webIntegrationId,
			'x-qlik-xrfkey' : 'abcdefghijklmnop'
        }
    })
    .then(async function(response)
    {
        //check if user is authenticated; if not, redirect to login page
		if(response.status===401){
            const url = new URL(`${urlQlikServer}/login`);
            url.searchParams.append('returnto', 'https://mymashup.com/mashup/Dash.html');
            url.searchParams.append('qlik-web-integration-id', webIntegrationId);
            window.location.href = url;
        }	
    })
    .catch(function(error)
    {
        console.error(error);
    });	
}	

/*
 * Bootstrap-based responsive mashup
 * @owner Enter you name here (xxx)
 */
/*
 *    Fill in host and port for Qlik engine
 */
//var prefix = window.location.pathname.substr( 0, window.location.pathname.toLowerCase().lastIndexOf( "/extensions" ) + 1 );

var config = {
    host: 'saas.us.qlikcloud.com', //for example, 'abc.us.example.com'
    prefix: '/',
    port: 443,
    isSecure: true,
    webIntegrationId: 'mykeywebintegration'
};


require.config( {
    baseUrl: ( config.isSecure ? "https://" : "http://" ) + config.host + (config.port ? ":" + config.port : "") + config.prefix + "resources",
    webIntegrationId: config.webIntegrationId,
	'x-qlik-xrfkey' : 'abcdefghijklmnop'
} );

 

 

 

 

 

Thank you all for your help

Labels (1)
  • SaaS

1 Reply
Ken_T
Specialist
Specialist

Likely will need to make some changes to the Content Security Policy in the SAAS Console...

this page has some examples that may help
https://qlik.dev/authenticate/content-security-policy/

and 
https://community.qlik.com/t5/Security-Governance/recommended-policy-for-Content-Security-Policy/td-...