An operation view extension is a web app that executes through the Windows or browser Operations Dashboard. In your production environment, you need to install and configure a web server to host your extensions. A few of the common web servers include IIS, OS X Server, and Apache.
You should consider the following factors when hosting operation view extensions on your web server.
Most ArcGIS organizations in production environments enforce web communications through Secure Socket Layer (SSL). While this might not be a requirement during the development phase, you should still consider enabling HTTPS access in your server to avoid creating mixed content. Operations Dashboard does not allow mixed active content that is caused by loading HTTP under an HTTPS connection. In addition, your server should have a valid SSL certificate issued by a certificate authority to establish the HTTPS connection.
When an extension is running in browser Operations Dashboard, it runs under the ArcGIS Online organization's domain, which is different from the domain of the web server hosting your extensions. You need to enable CORS in the web server so that the access from your ArcGIS Online organization's domain is allowed. If necessary, you can restrict CORS to allow requests from only arcgis.com.
Each operation view extension consists of a JSON manifest file that describes extension properties. Some web servers do not recognize the JSON file extension by default. In such cases, you'll need to add it to your server as a new MIME type at the application or a higher level. The MIME type should have “.json” as the file name extension, and “application/json” as the MIME type.