We have an issue with CORS policies and not sure of is a bug or?
We tried setting CORS policy on a product used in an API, without any effect. Then we applied the same CORS policy on API level for "all operations". This time it worked as expected.
As we understand CORS policy on product level should also be doable, we might be wrong or is there some detail we should be aware of to have this working on a product level?
If your product requires subscription for CORS policy to work key MUST be passed in query string. The problem here is if you try to pass subscription key in header browser will still send OPTIONS request without any extra headers. APIM will not be able to identify product and apply subscription key. Thus CORS policy will not work.
If key is passed in query string on the other hand, this information is presend in OPTIONS request and APIM works as desired.
This is not APIM problem per se, as CORS spec itself does not allow for any extra headers in OPTIONS request. And it only applies to requests that require preflight OPTIONS request. CORS GET requests should work as those are sent directly.
