Domain Whitelist (Allow Origin) Configuration - Admin Instruction

This Admin Instruction explains how to configure domain whitelist to protect PBX from cross-site request forgery (CSRF) attacks.

Created: April 2018

Updated: June 2018

WMS Version: 3.88


IMPORTANT: Trusted domains must be added to a domain whitelist! Please note that any Web API / PBX API integration will stop working if the domain is not added.

If you are using Firewalls, make sure the following pool of IP addresses is present in your Whitelist for access to Wildix microservices: 


The main purpose of adding domains to a whitelist is to protect PBX from cross-site request forgery (CSRF) attacks.

How it works:
Generally, web requests are restricted to only the current domain, per the same-origin policy. The same-origin policy is a significant security standard implemented by web browsers to prevent requests against a different origin (e.g., different domain) than the one from which it was served. At the same time, the same-origin policy also prevents legitimate interactions between a server and clients of a known and trusted origin.

To allow such interactions, Cross-origin resource sharing (CORS) is used. It is a standard that allows cross-domain requests. CORS can be defined as a set of headers that allow a browser and server to communicate about which requests are/ are not allowed. The simplest way is to check that the request originates from a trusted site, using Origin request header. For example, 


If a server decides that the request should be allowed, it sends
Access-Control-Allow-Origin header with the same origin that was sent. For example,


If this header is missing or the origins don’t match, then the request is not allowed. If origins match, then a browser processes the request.

Configuration of Domain Whitelist

Whitelist is configured in WMS -> Settings -> PBX -> Security -> CORS.

To configure a domain whitelist:

  1. Enter IP address/ domain name and click + to add the value:

    Supported formats of IP address/ domain name:

    • http://<domain or IP address> / https://domain or IP address> 
    • http://<domain or IP address>:port / https://<domain or IP address>:port



    It is also possible to add patterns using asterisk symbol "*" that replaces letters, numbers and dashes:

    • https://*
    • *://*

    • https://*.*

    Note: IP range can't be specified in this case. You just need to enter one IP address.

    Note: Wildix Portal "" and Wildix Chrome Extension "https://chrome-extension://lobgohpoobpijgfegnlhdnppegdbomkn" are hardcoded in the whitelist, there is no need to add them.

  2. After you enter all the values, click Save:

To delete the value from the list, click X.

Note: Starting from WMS 6.04.20230803.1, whitelisting domain can also be used to allow access to files (call recordings, voicemails, faxes). See more in documentation How to download files via different authorization types and CORS domain whitelisting