azure-api-management

How to configure response body of CORS error in Azure APIM Policy


I am using Azure API Management. And I added the CORS policy to my inbound section.

I noticed that I am getting a 200 status code and empty response body when the origin is not in the allowed-origin, e.g. if my origin header is https://google.com. That is due to the behaviour of terminate-unmatched-request.

However, I don't want the response body to be empty. I want my response body to return {"msg":"COR issue"}.What should i do? I know there are similar questions out there but Ican't find any working solution so far.

    <cors allow-credentials="false" terminate-unmatched-request="true">
        <allowed-origins>
            <origin>https://happygamer.com</origin>
        </allowed-origins>
        <allowed-methods>
            <method>*</method>
        </allowed-methods>
        <allowed-headers>
            <header>*</header>
        </allowed-headers>
        <expose-headers>
            <header>*</header>
        </expose-headers>
    </cors>

Solution

  • Use the given policy to get the response body and status code as well for CORS errors.

    <policies>
        <inbound>
            <cors allow-credentials="false" terminate-unmatched-request="true">
                <allowed-origins>
                    <origin>https://happygamer.com</origin>
                </allowed-origins>
                <allowed-methods>
                    <method>*</method>
                </allowed-methods>
                <allowed-headers>
                    <header>*</header>
                </allowed-headers>
                <expose-headers>
                    <header>*</header>
                </expose-headers>
            </cors>
            <choose>
                <when condition="@(context.Request.Headers.GetValueOrDefault("Origin") != null && context.Request.Headers.GetValueOrDefault("Origin") != "https://happygamer.com")">
                    <return-response>
                        <set-status code="403" reason="Forbidden" />
                        <set-header name="Content-Type" exists-action="override">
                            <value>application/json</value>
                        </set-header>
                        <set-body>{"msg":"CORS issue"}</set-body>
                    </return-response>
                </when>
            </choose>
        </inbound>
    </policies>
    

    Output-

    enter image description here