Is it needed to add CORS policy in the TargetEndPoint while it is already added in the ProxyEndPoint

Google Cloud Apigee
1

When dealing with an Apigee Proxy invoking a microservice API endpoint, it’s essential to determine where to add the CORS policy. Hence I am trying to understand at which endpoint (is it at TargetEndpoint or ProxyEndpoint) we should be adding CORS policy for below specific scenario.

Scenario: In a specific scenario where the Target endpoint API responds with a 400 Bad Request and an error object, a challenge arises when the UI, hosted on a different domain, is unable to retrieve the response when triggering the Apigee proxy (while preflight OPTIONS call was success as ProxyEndpoint has AM.CORS policy added already). Although the error messages are visible in the Apigee trace/logs, they are not reaching the browser.

In response to this issue, a potential solution was to experiment with adding the AM.CORS policy under the target endpoint in the DefaultFaultRule, which has shown promising results. For us, it’s important to verify if this approach aligns with best practices, as there is no explicit documentation in Apigee regarding adding the CORS policy in the TargetEndpoint’s DefaultRule.

Can you please help to clarify whether this approach is specifically relevant for error scenarios or if there is a more appropriate method to address this issue. Looking forward to correct way of handling this issue.

Regards,
Pankaj Sharma

2

I suggest you have a look at this walkthrough: https://youtu.be/OHbuqW_1fP0

And maybe try out this tool:
https://dinochiesa.github.io/cors-demonstrator/

Short answer is, no, you need to attach the CORS policy (available on X and hybrid) just once to an API Proxy. Ideally in the proxy request preflow.

But you need to configure it properly.

If you are NOT talking about the CORS policy, but instead an AssignMessage policy to set CORS headers, then YES, you need to attach an AssignMessage to the response flow, so that any response sent back gets the CORS headers. Probably this should be done in the proxy response flow. But you also need to handle the OPTIONS verb. So it’s more complicated.

Good luck.