Cors Error

Question

Access to XMLHttpRequest at 'https://comlinkonline.nl/v1/login' from origin 'https://bop.aygulyazilim.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Failed to load resource: net::ERR_FAILED

Since we installed de ISS certifcate we have this problem. WHat can we do to solve this problem.

Answer 1

• Ensure the CORS policy is added to your API Management instance. This involves adding the <cors> element to the inbound policy in APIM​​​​​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695#:~:text=Troubleshooting%3A%0A%0ATo%20troubleshoot%20t%20he%20CORS,cors%3E%20element%20added

https://learn.microsoft.com/en-us/azure/api-management/enable-cors-power-platform

https://www.cloudfronts.com/azure/how-to-solve-cors-error/#:~:text=,headers%3E%0A%0A%3C%2Fcors

• CORS policy can be applied globally (to all APIs) or at a specific API level. Remember that specific APIs and operations inherit policies from their parent APIs, so ensure the <base/> element is present where needed​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695

• In the policy, include the origin URL (e.g., https://bop.aygulyazilim.com) in the <allowed-origins> section​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695

• If you have other policies (like <rate-limit>) before the <cors> policy, this could cause CORS errors. Ensure that the <cors> policy is at the beginning of your inbound policy​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695

• If you're using product-level CORS settings, be aware that these settings only work when subscription keys are passed in query strings. Adjust the order of inbound policies at the product level if necessary​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695

• Avoid duplicate CORS settings at different levels, as this can cause conflicts. Check the effective policy to see which CORS setting is applied first and adjust accordingly​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695

• If custom headers like "ocp-apim-subscription-key" are used, make sure they're included in <allowed-headers> of your CORS policy​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695

• Pay attention to the terminate-unmatched-request attribute in your CORS policy, especially for non-preflight requests. This setting controls how APIM processes cross-origin requests that don't match CORS policy settings​​.

https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695