Then, when constructing the response to send to the caller, this policy will compare the actual passed-in Origin with the elements in the list. The configuration looks like this: Īs implied by the AllowOrigins element name, the text within AllowOrigins is a list, you can specify a list of origins that are valid. If you are using Apigee X or hybrid, then you should use the CORS policy. It should contain exactly one value, the Origin request header or * to indicate 'any origin'. Which means the response header should not contain a list. Indicates whether the response can be shared, via returning the literal value of the ` Origin` request header (which can be ` null`) or ` *` in a response. Please let me know if there is any easier way to solve this. I was thinking of doing a JS callout to check the value of origin against a comma separated list stored in KVM. This kind of options are available in other frameworks where we can configure all the allowed origins and the server will response with appropriate headers. Is there any inbuilt way to configure in Apigee to allow multiple valid origins so that Apigee will send only the valid origin according to the incoming request ? However, browser gives error saying that header contains multiple values. I tried to give comma separated values ( ) inside the allowed origins. I read that CORS helps to add security and is not a recommended to allow all origins since the proxy can be accessed by any website. I have added CORS policy to send below headers to fix CORS issue. Response.I have a set of proxies being consumed by multiple sites. If you don't have access to configure IIS, you can still add the header through ASP.NET by adding the following line to your source pages: Merge the following xml into the web.config file at the root of your application or site:

Enter Access-Control-Allow-Origin as the header name.In the Custom HTTP headers section, click Add.

Right click the site you want to enable CORS for and go to Properties.

Open Internet Information Service (IIS) Manager.

Header set Access-Control-Allow-Origin 'domain'.

Add the following line inside either the, , or sections of your server config (usually located in nf or nf), or within a.

Otherwise please follow the guidelines for different architectures below in order to set this header and permit outside domain. If this page is intended to be accessible to everyone, you don't need to take any action. The only case where this is appropriate when using the same-origin policy is when a page or API response is considered completely public content and it is intended to be accessible to everyone. This is generally not appropriate when using the same-origin security policy. Unless this HTTP header is present, such 'cross-domain' requests are forbidden by web browsers, per the same-origin security policy. Cross-origin resource sharing (CORS) is a mechanism that allows resources (e.g., fonts, JavaScript, etc.) on a web page to be requested outside the domain from which the resource originated.

Add access control allow origin header