如何使Azure API管理（API网关）CORS策略动态化？

Question

I want to add domains(Origins) in allowed-origins section dynamically in Azure API gateway. Is it possible ? Or is there another way we can setup the CORS, so that we can allow origins dynamically.

    <cors>
        <allowed-origins>
            <origin>http://www.example.com</origin>
        </allowed-origins>
        <allowed-methods>
            <method>GET</method>
            <method>POST</method>
        </allowed-methods>
    </cors>

Answer 1

You can't dynamically add elements to policy configuration, but you can dynamically provide values for them ( https://docs.microsoft.com/en-us/azure/api-management/api-management-policy-expressions ):

<cors>
    <allowed-origins>
        <origin>@(context.Request.Url.ToUri().GetLeftPart(UriPartial.Authority))</origin>
    </allowed-origins>
    <allowed-methods>
        <method>GET</method>
        <method>POST</method>
    </allowed-methods>
</cors>

Answer 2

I found one way that I'm mentioning bellow.

<inbound>
    <base />
    <send-request mode="new" response-variable-name="variable" timeout="600" ignore-error="true">
        <set-url>@("http://MyDomain/ApiMethod?Origin="(string)context.Request.Headers["Origin"].Last())</set-url>
        <set-method>GET</set-method>
        <set-body />
    </send-request>
    <cors>
        <allowed-origins>
            <origin>@((string)((IResponse)context.Variables["variable"]).Body.As<JObject>(true)["Origin"])</origin>
        </allowed-origins>
        <allowed-methods>
            <method>GET</method>
            <method>POST</method>
        </allowed-methods>
    </cors>
</inbound

• First called a API which takes the Origin as query parameter.
• stored the response in variable parameter.
• API Returns Json Object eg: { "Origin": " http://www.example.com " }
• Form the response I retrieve the Origin Value. and assign it to <origin></origin>