3712085 - Unknown origins is added as Access-Control-Allow-Origin in the Response Header when accessing SAP Analytics Cloud (SAC)

Unknown origins is added as Access-Control-Allow-Origin in the Response Header when accessing SAP Analytics Cloud (SAC)

SAP Analytics Cloud (Enterprise) 2025.21.11

1. Logon to SAC and capture the HTTP request via browser listener.
2. Find the following Request Header:
   Origin: YourSACTenantURL
3. Modify this request header to the following:
   Origin: any unknown URL
4. Send the request to SAC and find the following Response Header:
   Access-Control-Allow-Credentials: true
   Access-Control-Allow-Origin: unknown URL

This issue is currently under investigation by development group.

This issue is currently under investigation by development group.

security, untrusted, trusted, unexcepted, 3rd party, capture, tool, log , KBA , LOD-ANA-ADM , SAC Administration , Problem