Client script blocked: cross-origin request rejected

The external domain or URL is not included in the ServiceNow Content Security Policy (CSP) connect-src directive configuration. (high likelihood)

The client script is trying to make an XMLHttpRequest to an HTTPS endpoint from an HTTP ServiceNow instance, violating mixed content policies. (high likelihood)

The external API endpoint does not have proper CORS headers configured to allow requests from the ServiceNow instance domain. (medium likelihood)

ServiceNow's system property glide.ui.security.csp_enforcement_enabled is set to true but CSP policies are not properly configured for the required external domains. (medium likelihood)

The client script is attempting to access a subdomain or different port of the same domain without explicit CSP configuration. (low likelihood)

Step 1: Navigate to System Security > Content Security Policy to view current CSP configuration and identify if the target domain is listed in connect-src directive.

Step 2: Check the browser developer console Network tab to see the exact URL being requested and confirm the domain that needs to be whitelisted.

Step 3: Add the external domain to the Content Security Policy by going to System Security > Content Security Policy > CSP Whitelist and creating a new record with Type 'connect-src' and the required domain.

Step 4: Verify the system property glide.ui.security.csp_enforcement_enabled is properly configured by navigating to System Properties > System and searching for this property.

Step 5: Test the external API endpoint independently using a REST client to confirm it returns proper CORS headers including Access-Control-Allow-Origin for your ServiceNow instance domain.

Step 6: Clear browser cache and refresh the page to ensure the updated CSP configuration is applied to your client script execution.

Step 7: If the issue persists, consider implementing the API call server-side using a Script Include with REST Message or Scripted REST API instead of client-side XMLHttpRequest.