Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remove resource at https://<custom widget directory>/widget/manifest.json.

Error Message

When attempting to configure a custom widget in Web AppBuilder for ArcGIS in Portal for ArcGIS, clicking OK does not complete the configuration process. Instead, nothing happens, and the following error is returned in the web browser developer tools console:

Error:   
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remove resource at https://<custom widget directory>/widget/manifest.json (Reason: CORS header 'Access-Control-Allow-Origin' missing).

Note:
Custom widgets are stored on a web server and are accessed through a web address.

Cause

This issue occurs when the response headers sent from Portal for ArcGIS cannot access the Java libraries storing the custom widgets.

Solution or Workaround

Follow the steps listed below to resolve the issue:

1. Launch Internet Information Services (IIS) Manager.
2. Navigate to the folder containing the custom widgets in IIS.

3. Double-click HTTP Response Headers.
4. Click Add.

5. Add the following entry:

Name: Access-Control-Allow-Origin
Value: *

6. Click OK.