Azure OpenAI CORS

Question

Previously, Azure OpenAI "Bring your own data" feature required enabling CORS on the storage account. However, I can use this feature without CORS on a new storage account.

Has the CORS requirement been removed or changed by some enhancement?

If I enable "Turn on CORS", it allows all origins with "*" which poses a risk for the customer. How can I restrict its scope to only the customer's OpenAI instance? Are there any other ways to make this more secure?

Answer 1

Thanks for the details, You can use the OpenAI in your backend and Here is the documentation How to configure Azure OpenAI Service with managed identities.This document covers how to authenticate to your OpenAI resource using Microsoft Entra ID.

https://learn.microsoft.com/en-us/azure/ai-services/openai/how-to/managed-identity

Answer 2

To enhance security and restrict the scope to only your OpenAI instance, consider these steps:

Specify Origins: Instead of using "*", explicitly specify the origins allowed in the CORS settings. For example, if your OpenAI instance is hosted at a specific domain, specify that domain as the allowed origin.

Token-Based Authentication: Implement token-based authentication to ensure that only authorized requests are accepted. You can include a token with your requests and validate it on the server side.

Use HTTPS: If possible, make sure your OpenAI instance and the storage account use HTTPS. This helps to secure data during transmission.

Networking Restrictions: Utilize Azure networking features, such as virtual networks and service endpoints, to restrict access to the storage account from specific networks.

Regularly Monitor and Audit: Regularly monitor and audit access to your storage account to detect any unauthorized activity.

Keep Software Updated: Ensure that all software components, including your OpenAI instance and storage account, are up-to-date with the latest security patches.

Please refer to the latest Azure and OpenAI documentation for the most accurate and up-to-date information on security best practices.