I am using Azure API Management. And I added the CORS policy to my inbound section.
I noticed that I am getting a 200 status code and empty response body when the origin is not in the allowed-origin, e.g. if my origin header is https://google.com. That is due to the behaviour of terminate-unmatched-request.
However, I don't want the response body to be empty. I want my response body to return {"msg":"COR issue"}.What should i do? I know there are similar questions out there but Ican't find any working solution so far.
<cors allow-credentials="false" terminate-unmatched-request="true">
<allowed-origins>
<origin>https://happygamer.com</origin>
</allowed-origins>
<allowed-methods>
<method>*</method>
</allowed-methods>
<allowed-headers>
<header>*</header>
</allowed-headers>
<expose-headers>
<header>*</header>
</expose-headers>
</cors>
Use the given policy to get the response body and status code as well for CORS errors.
<policies>
<inbound>
<cors allow-credentials="false" terminate-unmatched-request="true">
<allowed-origins>
<origin>https://happygamer.com</origin>
</allowed-origins>
<allowed-methods>
<method>*</method>
</allowed-methods>
<allowed-headers>
<header>*</header>
</allowed-headers>
<expose-headers>
<header>*</header>
</expose-headers>
</cors>
<choose>
<when condition="@(context.Request.Headers.GetValueOrDefault("Origin") != null && context.Request.Headers.GetValueOrDefault("Origin") != "https://happygamer.com")">
<return-response>
<set-status code="403" reason="Forbidden" />
<set-header name="Content-Type" exists-action="override">
<value>application/json</value>
</set-header>
<set-body>{"msg":"CORS issue"}</set-body>
</return-response>
</when>
</choose>
</inbound>
</policies>
Output-