CefAddCrossOriginWhitelistEntry

Header: cef_origin_whitelist.h
Interfaces: CefAddCrossOriginWhitelistEntry, CefRemoveCrossOriginWhitelistEntry, CefClearCrossOriginWhitelist
Category: System Utilities

Overview

Tasks, threads, parsers, streams, cookies, URL requests, scheme registration, and constant tables.

CefAddCrossOriginWhitelistEntry (free function)

Source File: include/cef_origin_whitelist.h

Process / Thread Context: Any thread (header: "This function may be called on any thread.").

Purpose: Add an entry to the cross-origin access whitelist, allowing scripts hosted underneath the source_origin URL to access resources on the specified target_protocol/target_domain that would otherwise violate the same-origin policy.

Methods

`bool CefAddCrossOriginWhitelistEntry(const CefString& source_origin, const CefString& target_protocol, const CefString& target_domain, bool allow_target_subdomains)`

Parameters:

source_origin: Fully-qualified source origin URL (e.g. http://www.example.com). Scripts hosted underneath this URL are granted access.
target_protocol: The protocol of the resources to allow (e.g. "http", "https").
target_domain: The target domain. If non-empty and allow_target_subdomains is false, only exact domain matches are allowed. If it contains a top-level domain component (e.g. "example.com") and allow_target_subdomains is true, sub-domain matches are also allowed. If empty and allow_target_subdomains is true, all domains and IP addresses are allowed.
allow_target_subdomains: Sub-domain matching toggle (see above).

Return Value: Returns false if source_origin is invalid or the whitelist cannot be accessed; otherwise true.

Usage Instruction: Use to grant cross-origin access programmatically (i.e. without requiring Access-Control-Allow-Origin headers). Cannot be used to bypass restrictions on local or display-isolated schemes.

Threading Constraint: Any thread.

CefRemoveCrossOriginWhitelistEntry (free function)

Source File: include/cef_origin_whitelist.h

Process / Thread Context: Any thread.

Purpose: Remove an entry from the cross-origin access whitelist. The parameters must match an entry previously added with CefAddCrossOriginWhitelistEntry.

Methods

`bool CefRemoveCrossOriginWhitelistEntry(const CefString& source_origin, const CefString& target_protocol, const CefString& target_domain, bool allow_target_subdomains)`

Parameters:

Identical semantics to CefAddCrossOriginWhitelistEntry.

Return Value: Returns false if source_origin is invalid or the whitelist cannot be accessed; otherwise true. Removing a non-existent entry is not an error per the header.

Usage Instruction: Use to revoke previously granted cross-origin access.

Threading Constraint: Any thread.

CefClearCrossOriginWhitelist (free function)

Source File: include/cef_origin_whitelist.h

Process / Thread Context: Any thread.

Purpose: Remove all entries from the cross-origin access whitelist.

Methods

`bool CefClearCrossOriginWhitelist()`

Parameters:

None.

Return Value: Returns false if the whitelist cannot be accessed; otherwise true.

Usage Instruction: Use during teardown or reconfiguration to wipe the whitelist.

Threading Constraint: Any thread.

Usage Example

cpp

// Allow https://app.example.com to call any http(s) URL on *.example.com.
CefAddCrossOriginWhitelistEntry(
    "https://app.example.com", "https", "example.com",
    /*allow_target_subdomains=*/true);

// Later, revoke just that one entry:
CefRemoveCrossOriginWhitelistEntry(
    "https://app.example.com", "https", "example.com", true);

// Or wipe the entire whitelist:
CefClearCrossOriginWhitelist();

CefAddCrossOriginWhitelistEntry ​

Overview ​