APIM Policy for Cross origin

Question

APIM Policy for Cross origin

Upasana Ghosh 351

We have CORS feature enabled API Gateway need to block / allow the Cross Origin requests

Accepted answer

1 additional answer

Your answer

Answer 1

MuthuKumaranMurugaachari-MSFT 22,441 Moderator

@Upasana Ghosh Thank you for reaching out to Microsoft Q&A. Based on the statement above, you can use cors policy to set allowed origins, methods, headers etc. and refer doc for more info.

Note, there is attribute terminate-unmatched-request which controls the processing of cross-origin requests and see the description below:

For non-flight requests such as GET, HEAD You might see empty 200 response based on the default value (true) and hence you would have to set the attribute to false as mentioned in Scenario 7: terminate-unmatched-request in the blog.

I hope this answers your question and feel free to add a comment if you have any other questions. We would be happy to assist you. Please ‘Upvote’ if it helped so that it can help others in the community.

Upasana Ghosh 351 Reputation points

2023-01-10T10:21:34.943+00:00

hello Thank you for your reply . Can you elaborate how can i implement
Upasana Ghosh 351 Reputation points

2023-01-10T18:29:15.493+00:00

@MuthuKumaranMurugaachari-MSFT hello Muthu can you please provide some feedback on the above comments
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-01-10T18:51:41.463+00:00

@Upasana Ghosh Sure, will respond by the end of the day.
MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-01-10T19:36:51.133+00:00

@Upasana Ghosh The above policy snippet appears to be good. When you set terminate-unmatched-request as true, APIM immediately terminates the request and returns empty 200 response if Origin header doesn't match (based on allowed origins, methods etc.). However, if you set it as false, then APIM would process the request normally and return response like 404 Resource Not Found as mentioned in the tech article.

You can test API calls via developer portal since it uses different domain such as developer.azure-api.net and in my test it resulted in 404 error.

Also note CORS is mechanism implemented and enforced by browsers and hence you might see 200 empty response elsewhere (refer article). I hope this helps with your question and feel free to add any other questions or issues if you encounter. Would be happy to answer.

Answer 2

Upasana Ghosh 351

............................

MuthuKumaranMurugaachari-MSFT 22,441 Reputation points Moderator

2023-01-11T14:13:52.6666667+00:00

@Upasana Ghosh Based on the error message, it appears that Origin header was missing in the request. Refer Cors doc which has sample request and response or blog which has Origin header in the screenshot and add it in your request. Let me know if you face any issues.

Share via

APIM Policy for Cross origin

1 additional answer

Your answer