Experience Builder Developer Edition can't access web map service

[EMiller_2]

My application built with Experience Builder Developer Edition uses a map in my organization's arcgis online account which features a web map service coming from my organization's arcgis server.

The map and service are publicly accessible, but Ex Builder throws the map service to a proxy and the application/browser refuses the service.

The blocked url displays in this format when viewed with browser developer tools:

https://<<my organization>>.arcgis.com/sharing/proxy?https://<<my arcgis map service>>/MapServer?f=json 

I have another map that works fine in the same application. The difference is that the two map services are coming from two different servers at my organization. 

The successful service displays this way in my browser tools:

https://<<my arcgis map service>>/MapServer?f=json 

I believe the differences are due to server Content Security Policy settings, which are different on the two servers (where the map services are coming from). I am trying to work with my organization's server admins to get things to work but I can't tell them what is causing Experience Builder to throw in that proxy reference for the service coming from one server but not the service coming from the other server, which works fine. They insist the problem is Experience Builder and are reluctant to help with CSP settings.

Can anyone explain what could be causing this format of https://<<my organization>>.arcgis.com/sharing/proxy? and what could be triggering the refusal?

[JeffreyThompson2]

Do you have your clientId in the config.json file?

https://developers.arcgis.com/experience-builder/guide/deployment-topics/#deploy-the-experience

[EMiller_2]

Thanks very much but that is not the issue. There is no private content. In addition, the exact application works fine with the map service coming from the other server.

I could point out that I have a version of the app built with Web App Builder Developer Edition which uses the same maps/map services. Web App Builder does not have a problem with either service. So it seems to be triggered by something that Experience Builder handles differently than Web App Builder.

But still, one service works, the other doesn't.

[EMiller_2 · Accepted solution]

This issue was resolved when the server admin finally checked the server config files (for the server where the services are being served out of).

While Web App Builder did not complain, Experience Builder had a problem when the config file read:

Header set Access-Control-Allow-Origin "*"

To resolve the error, this needed to be changed to:

Header always set Access-Control-Allow-Origin "*"

I am still interested if someone can explain why the two esri applications behave differently and where this difference can be seen in the application code. Why is Experience Builder more sensitive?