CORS errors when using an Azure CDN with multiple origins
We have set up custom rules on the Azure CDN Standard endpoint to modify (overwrite) the response header based on the Origin of the request. In the rules defined, we are setting the Access-Control-Allow-Origin header value to the same value as that of the Origin of the request for all of the domains of the below-mentioned sites. 
We have multiple sites getting data served from the CDN URLs:
- A main content delivery environment
- A preview content delivery environment
We are seeing some CORS errors when accessing the sites and switching between the environments. These all seem to be related to .woff extension font files. This is an example error:
Access to font at 'https://cdn.example.com/example.woff' from origin 'https://sitename.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://sitename-preview.com' that is not equal to the supplied origin.
It is as if the rules set up for the CDN endpoint do not get acknowledged if you have already accessed a site from a different URL where you already requested assets from the CDN.
Microsoft has acknowledged that there is a problem in the multiple origin scenario here: https://learn.microsoft.com/en-us/azure/cdn/cdn-cors, but the proposed solution only caters to a single origin. If we add multiple origins to separate rules, then we still end up with the problem that occurs when the browser caches the Access-Control-Allow-Origin header for the first CORS origin.
Is there any workaround for this, other than to change the Access-Control-Allow-Origin header to * and put the CDN behind a WAF? I've read that the CORS spec is all or nothing here: Access-Control-Allow-Origin wildcard subdomains, ports and protocols, where the most upvoted answer states that it only supports *, null or the exact protocol + domain + port.
We worked around this issue by setting the Cache-Control property in the response header for .woff extension files to 'no-cache' within the Azure CDN endpoint caching rules.
- Preflight request is succeeds, but GET request fails with CORS error status code 200 OK
- Restful-API node.js & expressCross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource s cat. Statuode: (null)
- I migrated my javascript client to another domain and now cross site call to php api are not sharing the same php session
- CORS - Response to preflight request doesn't pass access control check: It does not have HTTP ok status
- How do i allow a CORS requests in my google script?
- Are there any browsers that set the origin header to "null" for privacy-sensitive contexts?
- Android Webview: disable CORS
- Cors issue local xampp server and react frontend
- Why does my JavaScript code receive a "No 'Access-Control-Allow-Origin' header is present on the requested resource" error, while Postman does not?
- Cross-Origin Resource Sharing on GitHub Pages
- CORS issue with NGinx and fetch react native
- Preflight request from React Client with ASP.NET Core backend blocked by CORS policy
- Testing CORs in SpringBootTest
- How to fix "CORS 502 Error" Preflight issue with Express backend on Railway and Vue.js frontend on Vercel?
- XMLHttpRequest cannot load XXX No 'Access-Control-Allow-Origin' header
- Request header field Access-Control-Allow-Headers is not allowed by itself in preflight response
- JasperReports Server Bitnami Docker Image Running in Azure App Service Custom Web.xml
- Error: Cannot find module 'cors'
- Unable to find definition of mvc:cors
- Chrome NOT performing a preflight request
- XMLHttpRequest error in flutter web [Enabling CORS AWS API gateway]
- OPTIONS Request made to domain root (/) on ddev nginx throws a 405 - We see access.log but the request is not forwarded to index.php
- Using the 'integrity' attribute for script tags while avoiding CORS errors over the file-uri protocol
- Firebase https onCall function blocked by cors
- Why does express router get blocked by CORS but router routes do not?
- Handle Cors from lambda to cloudfront or s3
- SCORM issues with packages that load content from an external domain on a popup window
- Cors Error when calling microservice from Vue frontend application
- NestJS enable cors in production
- Can we not set Allowed Headers for Azure App Service?