'Transfer Error' Encountered While Uploading Images in VMware Cloud Director Customize UI Theme.

Products

• VMware Cloud Director

Issue/Introduction

• When attempting to upload images in the Branding section of the Customize UI Theme, a 'Transfer Error' is encountered in the VCD user interface.                                                                                                                 
• Network browser logs indicate a '403 Forbidden' response when trying to transfer the image file to the VCD instance.                                                      
• /opt/vmware/vcloud-director/logs/vcloud-container-debug.log indicate the errors regarding the invalid cross-origin requests:

  2025-##-## ##:##:##,### | WARN     | pool-jetty-202865         | CorsFilter                     | Invalid cross-origin request to https://<IP_address>/transfer/<resource_ID>/resources.zip detected.  Request Origin: <Origin_VCD_Address>, Allowed Origins: <[.........<Allowed_Addresses>.........]>
   | requestId=####-####-####-####,request=OPTIONS https://<IP_Address>/transfer/<resource_ID>/resources.zip,requestTime=$$$$$$$$,remoteAddress=##.##.##.##:####,userAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=*/*

Environment

Cloud Director 10.5.x

Cloud Director 10.6.x

Cause

The CORS (Cross-Origin Resource Sharing) settings specify which origins are permitted to interact with the Service Provider Admin Portal and the Tenant Portal. Adding the missing origin ensures that valid UI customization requests are accepted and processed successfully.

Resolution

Ensure to add the Request origin entry mentioned in the below log snippet to the CORS details.

 Invalid cross-origin request to https://<IP_address>/transfer/<resource_ID>/resources.zip detected.  Request Origin: <Origin_VCD_Address>

Refer: Configure CORS for VMware Cloud Director

To modify the CORS settings, you will need to use the Cloud API with PUT Request.

https://{{base-url}}/cloudapi/1.0.0/site/settings/cors

 

This API and the majority of all /cloudapi/ APIs can be interacted with via the API Explorer.

https://{{base-url}}/api-explorer/provider#/cors

Note: A valid set of System Administrator credentials is required to access this, similar to the UI.

Within the CORS section of the API Explorer, there will be 2 APIs you will need to leverage.

GET /1.0.0/site/settings/cors
PUT /1.0.0/site/settings/cors

Refer: Modifying the "webapp.allowed.origins" configuration on version 10.3 and later