Wildcard domains are not supported in APIM cors policy

Question

Hi Team,

When I try to add a CORS domain with a wildcard in the APIM CORS policy, it is not supported. Can you please help me with this?.

<policies>
    <inbound>        
        <cors allow-credentials="true">
            <allowed-origins>
                <origin>https://*.os.au</origin>                
            </allowed-origins>
            <allowed-methods preflight-result-max-age="300">
                <method>GET</method>
                <method>POST</method>
                <method>PUT</method>
                <method>DELETE</method>
            </allowed-methods>
            <allowed-headers>
                <header>*</header>
            </allowed-headers>
            <expose-headers>
                <header>*</header>
            </expose-headers>
        </cors>

Answer 1

Hello Hari , Welcome to MS Q&A

It is because in Azure API Management, if the allowed origin is set to a wildcard ('*'), it cannot have CORS allowed credentials set to true. This is because specifying AllowAnyOrigin and AllowCredentials together is not secure and can lead to vulnerabilities such as cross-site request forgery.

CORS (Cross-Origin Resource Sharing) in Azure API Management supports wildcard origins, but there are important considerations. When using a wildcard (*) for allowed origins, you cannot also specify AllowCredentials. This combination is not secure and can lead to vulnerabilities such as cross-site request forgery. Instead, if you need to allow credentials, it's recommended to replace the wildcard with specific origins or wildcard subdomain

For more details, you can refer to the following documentation:

• CORS in Azure API Management

Please let us know if any further questions

Kindly accept answer if it helps

Thanks
Deepanshu