Cors error being thrown from APIM developer portal for return-response policy

Question

I am trying to run my APIM API from.developer portal. I have added the full CORS policy as below:

<cors>
<allowed-origins>
<origin></origin>
</allowed-origins>
<allowed-methods>
<method>GET</method>
<method>POST</method>
<method>PUT</method>
<method>DELETE</method>
<method>HEAD</method>
<method>OPTIONS</method>
<method>PATCH</method>
<method>TRACE</method>
</allowed-methods>
<allowed-headers>
<header></header>
</allowed-headers>
<expose-headers>
<header>*</header>
</expose-headers>
</cors>

It works fine until i add return-response policy within on-error - then it again starts throwing the cors policy error- asking to enable cors on browser, even though cors already is enabled. Is there any other cors tag to add?

My on-error code:
<on-error>
<choose>
<when condition="@(context.Response.StatusCode != 200)">
<return-response>
<set-status code="@(context.Response.StatusCode)" reason="@(context.LastError.Reason)" />
<set-body>
new JProperty("Error Reason", context.LastError.Reason)
).ToString();
}</set-body>
</return-response>
</when>
<otherwise />
</choose>
<base />
</on-error>

I have checked after changing origin * to origin as link of the dev portal - I get the same error

The policy works on postman.

Answer 1

Hello @Sanchita Sengupta , Welcome to Microsoft Q&A! Thanks for posting the question.

Can you please confirm if you have the cors policy applied at Global API level or at product level? I ask because based on the information here if you apply the CORS policy in the Product scope, instead of the API(s) scope, and your API uses subscription key authentication through a header, your console won't work. The browser automatically issues an OPTIONS HTTP request, which doesn't contain a header with the subscription key. Because of the missing subscription key, API Management can't associate the OPTIONS call with a Product, so it can't apply the CORS policy. As a workaround you can pass the subscription key in a query parameter.
Please let me know if there are any concerns. Thank you!

Answer 2

In on-error section, do not use <return-response>. Then this problem will not happen.