How to disable Azure App Service CORS entirely

Question

How to disable Azure App Service CORS entirely

RM 6

Hi Team,

I have an ASP.NET Core 5 application with CORS enabled that works as expected locally, but not when hosted in an App Service. It does if I configure the allowed origins on the App Service itself, but by doing so I understand it overrides the application's policy, which isn't desired behaviour as it doesn't allow the same granularity of control we require.

Every literature I could find indicates that if the CORS config in the Azure portal is completely blank then the application would be responsible for handling these requests but that does not seem to be the case currently.

How can I completely disable CORS at the App Service level and let the application handle that itself?

Using resources.azure.com I can confirm that having the "cors" node omitted from the template, or set to the following, makes no difference whatsoever:

        "cors": {
          "allowedOrigins": [],
          "supportCredentials": false
        }

Any help greatly appreciated.

Best regards.

1 answer

Your answer

Answer 1

Ryan Hill 30,281 Microsoft Employee Moderator

You can use the Azure CLI command az webapp cors remove --allowed-origins to remove CORS. From the portal, search for CORS under your app service and remove any origins that's listed.

You are correct on the following:

Every literature I could find indicates that if the CORS config in the Azure portal is completely blank then the application would be responsible for handling these requests but that does not seem to be the case currently.

Since you don't have any listed origins, the issue may be something else. I'm assuming you enabled CORS like https://learn.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0? Can you elaborate further on the issue you're seeing?

Regards,
Ryan

FENG CHEN 21 Reputation points

2023-08-09T03:14:34.0433333+00:00
I am having the same issue, and "az webapp cors remove --allowed-origins" doesn't fix the issue.

Step to repro

before I add any url into Azure app service, the portal shows empty allowed origins.

"az webapp cors show -g rg-app -n myappname" shows empty result ( nothing at all).

Add a url into allowed origins. rerun "az webapp cors show -g rg-app -n myappname" , result:

{ "allowedOrigins": [ "https://microsoft.com" ], "supportCredentials": false }

Now remove https://microsoft.com from the allowed origins, from Azure portal, it looks exact same as the very beginning. but "az webapp cors show -g rg-app -n myappname" result:

{ "allowedOrigins": [], "supportCredentials": false }

Now allowedOrigins is a empty list , not a null.

I didn't find any option to reset the cors setting to the original status.

Share via

How to disable Azure App Service CORS entirely

1 answer

Your answer