How To - Add Custom Response Headers (Manipule web.config for cases like CORS)

Within OutSystems Cloud, unfortunately, isn't possible to access the IIS directly. Even when you need to change some simple configurations, like adding a specific header to the web.config file or increase the IIS limits to upload files. However, using a powerful tool available for everyone within forge (Factory Configuration) we are allowed to manipulate and include that so much required headers in the web file config.

This example is for CORS headers, please check the step-by-step guide below.

Note: This post is based on the already created article (https://www.outsystems.com/forums/discussion/16964/how-to-add-custom-response-headers/), nevertheless, I'm creating this one to remove the references to IIS and to add a more understandable step-by-step because people have shared that the first steps of the guide were confusing.


1 - Download and Install on your environment the Forge component "Factory Configuration" (https://www.outsystems.com/forge/component-overview/25/factory-configuration)

2 - Open the page https://<Environment_URL>/FactoryConfiguration in a browser and log in using Service Center Credentials.

3 - Click on "Shared Configuration" > "Create New Shared Configuration"

4 - Add a meaningful "Name" to the configuration and add the XSLT template to the "Value" input by clicking the button "FILL"

5 - Look for and replace the two following lines:

<xsl:attribute name="executionTimeout">180</xsl:attribute>
<xsl:attribute name="maxRequestLength">65536</xsl:attribute>


<add name="Access-Control-Allow-Origin" value="*" />
<add name="Access-Control-Allow-Methods" value="GET,POST,OPTIONS" />
<add name="Access-Control-Allow-Headers" value="*" />

afterward, search for the following line:

<xsl:template match="/configuration/system.web/httpRuntime">

and replace with:

<xsl:template match="/configuration/system.webServer/httpProtocol/customHeaders">

6 - Click on tab "eSpaces" > search for the module that you want to change the headers > check the modules you want to add the configuration and click "Associate Shared Configuration"

7 - After finishing the steps above, don't forget to REPUBLISH your module.

8 - After republishing the module you should be able to see the headers within the requests of that module pages or services.


Hope this helps our community developments!

Kind Regards.

Rank: #77737

Yes I did all the steps and it does not work. 

Rank: #43737

I've followed all the step, but now I'm getting the following error: "'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed"


Rank: #112

Hello Renan,

It seems the 'Access-Control-Allow-Origin' header was already on the request.

Try removing from the configuration that specific header mentioned, point 5 on my instructions, the one below, and republish the module.

<add name="Access-Control-Allow-Origin" value="*" />

Kind Regards.

Rank: #119

Are you sure you're not trying this in a Personal Environment? I believe Factory Configuration doesn't work at all in these environments...

Rank: #14119

Hi. I just want to confirm this forge component adds CORS customer headers to the IIS in use right? There is no way to change an existing Access-Control-Allow-Origin header value return by an exposed REST api?

Rank: #1135

Is this doesn't work for personal environment? because i keep getting 404 page when visiting the https://<Environment_URL>/FactoryConfiguration

Rank: #18

Hi Kevin Wie,

You need to install it from the forge, it's the 1st step of João's explanation:

1 - Download and Install on your environment the Forge component "Factory Configuration" (https://www.outsystems.com/forge/component-overview/25/factory-configuration)

Rank: #32


In Service Center you need to change the Integration URL for the consumed SOAP service to your personal environment as per the below:

Note to Author: This should be added as a step in the instructions...

Rank: #32

You have to browse to the FactoryConfiguration eSpace in Service Center. You can find this under the Factory tab

Click on the FactoryConfiguration eSpace. Then click on the Integrations tab. Lastly, click on the Operation link under Consumed SOAP Web Services:

Enter in the effective URL field, the URL as per your Personal Environment:

Finally, click on the Apply button to make the change effective.

Rank: #1602

Hi Team,

Assume www.abc@xyz.com to be the domain and the soap service which we are consuming is www.test@xyz.com 

Which url should be configured in the 

<add name="Access-Control-Allow-Origin" value="*"  /> 

and, which should be set up in the

Integrations Tab -  Operation link under Consumed SOAP Web Services

Thanks in advance

Hello Neha

You wake up an old discusión from more than a year ago.

It would be better to start a new discussion and include link to the old post.

Best Regards