Not Monitored
Tag not monitored by Microsoft.
43,321 questions
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I would like to track which domains my current api management resource is allowing so i can better secure my api management cors policy. Currently I have this setup; however when I look it up in application insights I get an Origin: None on all entries. How can I trace the exact domains that my api managements resource is currently allowing?
<policies>
<inbound>
<!-- Capture and trace Origin header -->
<set-variable name="originHeader" value="@(context.Request.Headers.GetValueOrDefault("Origin", "none"))" />
<set-header name="x-origin" exists-action="override">
<value>@((string)context.Variables["originHeader"])</value>
</set-header>
<trace source="OriginTracker">@("Origin: " + (string)context.Variables["originHeader"])</trace>
<!-- CORS Configuration -->
<cors allow-credentials="true">
<allowed-origins>
<origin>https://apimv.developer.azure-api.net</origin>
</allowed-origins>
<allowed-methods preflight-result-max-age="300">
<method>*</method>
</allowed-methods>
<allowed-headers>
<header>*</header>
</allowed-headers>
<expose-headers>
<header>*</header>
</expose-headers>
</cors>
<!-- HTTPS Redirection -->
<choose>
<when condition="@(context.Request.OriginalUrl.Scheme.Equals("http"))">
<return-response>
<set-status code="302" reason="Requires SSL" />
<set-header name="Location" exists-action="override">
<value>@("https://" + context.Request.OriginalUrl.Host + context.Request.OriginalUrl.Path)</value>
</set-header>
</return-response>
</when>
</choose>
</inbound>
<backend>
<forward-request />
</backend>
<outbound />
<on-error />
</policies>