A botanical garden SPA hosted on a different origin calls a JSON API on App Service, but the browser blocks the response. Which App Service configuration should the developer update first?
Select an answer to reveal the explanation.
Short Explanation
Browsers enforce same-origin rules like a bouncer checking guest lists. When the SPA lives elsewhere, App Service CORS must explicitly allow that origin. Reaching for APIM policies or Container Apps ingress here just moves the problem to the wrong host.
Full Explanation
Cross-Origin Resource Sharing is configured on App Service under API settings so browsers can read responses from allowed origins. API Management policies belong to Domain 5 integration work. Container Apps ingress CORS applies only when the API actually runs on Container Apps, which this scenario does not.