How can I customize CORS policy response

Question

Hi,

We're testing the CORS policy and need to know if it's possible to customize the response code/body.

<cors allow-credentials="false" terminate-unmatched-request="true">
  <allowed-origins>
    <origin>origin uri</origin>
  </allowed-origins>
</cors>

When the request doesn't match allowed origins under terminate-unmatched-request="true", the response is a 200 with an empty value.

Our client finds this confusing; it's hard to tell if the empty response indicates normal operation or a CORS block.

Can you advise if we can customize the response? Thank you.

Answer 1

Hi @Lily,

I know APIM does allow conditionally overriding header values. You may be able to use the set-body policy to override as well.

<cors allow-credentials="false">
    <allowed-origins>
        <origin>https://test.org</origin>
    </allowed-origins>
</cors>
<choose>
    <when condition="@(context.Request.Headers.GetValueOrDefault("Origin","").Contains("allowedOrigin.com"))">
        <set-body template="none" />
    </when>
    <otherwise />
</choose>

However, what I suggest is setting terminate-unmatched-request to false, per Scenario 7: terminate-unmatched-request on https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-troubleshoot-cors-error-in-azure-api-management-service/ba-p/2241695