A city’s open-data single-page app in the browser must call an OCI API Gateway deployment. Developers need the gateway to answer CORS preflight and attach the configured CORS headers on actual responses. How should CORS be implemented?
Select an answer to reveal the explanation.
Short Explanation
Browsers ask permission before a page on one origin may call another—CORS is that permission slip. On OCI API Gateway you attach a CORS request policy (globally or per route) so the gateway answers preflight and stamps the headers you configure. It is not a Function you write and not an OKE Ingress annotation drill.
Full Explanation
OCI API Gateway documents CORS as a request policy. The gateway answers browser preflight and actual requests with the CORS headers you configure—origins, methods, headers, credentials, and max-age. You can attach the policy globally on the deployment or on selected routes. CORS is handled at the gateway policy layer; it is neither a custom Function nor an OKE Ingress exercise.