Item does not exist or is inaccessible

Error Message

Attempting to add a secure Web Feature Service (WFS) from a third-party Open Geospatial Consortium (OGC) server in Portal for ArcGIS and ArcGIS Online returns the error message:

Error:   
Item does not exist or is inaccessible.

Developer tools also return the error message:

Error:   
The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

The issue is only present in applications using JavaScript to display data, such as ArcGIS Online and Portal for ArcGIS. The WFS can be added to ArcMap or ArcGIS Pro, and the XML can be viewed when the URL and credentials are entered in a browser.

Cause

The error is caused by the way the service is set up, and how Cross-Origin Resource Sharing (CORS) interacts with programs using JavaScript.

When the 'Credentials' mode is set to 'Include', a wildcard cannot be used as the Access Control Origin. The wildcard in the Access Control Origin tells the OGC service that any domain can request to see the service. With JavaScript applications, using a wildcard for the Access Control Origin does not require credentials.

Note:
A wildcard cannot be used when credentials are required, as it is too permissive, and defeats the purpose of requiring credentials. This is a security risk.

Solution or Workaround

In the Web Feature Service, change the Access Control Origin from the wildcard '*' to include any origin requesting the service. Add the portal origin or any other domain to this location in the service.

Note:
The method for applying the solution above can be different for each server, as it is done in a third-party server.