Skip to content
Point of Contact

Allowed origins

ALLOWED_ORIGINS is a comma-separated list of scheme+host values that may call your customer Function App’s chat endpoints from a browser. Set during install via the wizard — and hard to change afterwards (see How to update), so enter your real domains up front rather than leaving the * default.

Format

  • https://www.acme.com — single origin
  • https://www.acme.com,https://support.acme.com — multiple
  • * — open access (only OK during evaluation)

No paths. No trailing slashes. No wildcards in subdomains.

Two places it’s used

  1. App Service CORS — handles OPTIONS preflight at the platform edge.
  2. Per-response header — the customer-runtime sets Access-Control-Allow-Origin on each chat response (reads the ALLOWED_ORIGINS app setting).

Both are set from the same wizard value at deploy time — you don’t manage them separately.

What CORS does (and doesn’t) protect

The allowlist stops browsers on other websites from embedding your widget or reading chat responses. It does not block non-browser clients (curl, scripts) — the chat endpoints are anonymous by design and additionally rate-limited per client IP and session. See Security & compliance for the full picture.

With the wizard default of *, any website can embed your widget. Fine for evaluation; tighten before production.

How to update

Being honest about a current limitation: there is no self-service way to change ALLOWED_ORIGINS after install yet.

  • The Marketplace Change plan blade only updates plan settings (seat quota, plan name) — it does not re-run the deploy wizard or touch origins.
  • The Managed RG is read-only for your tenant, so az functionapp config appsettings set / portal edits are denied.

The supported path today is a support request: send your stack name and the full replacement origin list, and we update both the ALLOWED_ORIGINS app setting and the platform CORS list with our publisher access (the change shows up in your Activity Log; takes effect within minutes). A self-service origins editor is on the roadmap.

Because of this, set your real domains in the wizard — including any staging domains you’ll want later.