A heron-pool browser app is blocked by CORS after the municipal API is imported into API Management. What should the developer add instead of documenting around the error in the developer portal?
Select an answer to reveal the explanation.
Short Explanation
CORS is a gateway policy, not a portal paint job. Add the cors policy so preflight and responses carry the right Access-Control headers for the browser app.
Full Explanation
Browsers enforce CORS. After a heron-pool municipal API is imported into API Management, the developer must add the cors policy—typically covering inbound preflight (OPTIONS) and the Access-Control response headers—so the browser app’s allowed origins are explicit. Documenting around the error in the developer portal does not fix the wire protocol.
A custom CSS theme in the developer portal that hides the browser console fails because cosmetics do not emit Access-Control-Allow-Origin or handle preflight; the SPA still fails CORS checks.
An Event Grid system topic that rewrites Access-Control headers on every SPA fails because Event Grid delivers discrete events; it is not a CORS middleware for APIM responses.
Checked-in CORS middleware only inside Redis fails on two counts: Redis is not where browser preflight is answered for an APIM-fronted API, and CORS belongs on the gateway (or the origin) that actually serves the HTTP response.
Exam caveat: cors policy must list the real browser origins (or a deliberate wildcard strategy) and the methods/headers the SPA uses—partial allow lists still produce browser failures. Operational check: from the SPA origin, trigger a preflight OPTIONS through APIM and confirm 2xx with the expected Access-Control-Allow-* headers, then verify the actual API call succeeds in the browser network panel.