You are configuring inbound request processing rules for an API in Azure API Management (APIM). You need to allow cross-origin resource sharing (CORS) and limit the rate of incoming calls based on the client IP address.
Which two of the following configurations must you perform to implement these policies? (Select two.)
- Place the cors policy within the inbound section of the policy document.Answer
- Place the rate-limit-by-key policy within the inbound section of the policy document.Answer
- CPlace the cors policy within the outbound section of the policy document.
- DPlace the rate-limit-by-key policy within the outbound section of the policy document.
Answer
Configure both the cors policy and the rate-limit-by-key policy within the inbound section of the policy document.
Both cross-origin resource sharing (CORS) rules and client-side rate limiting are request-filtering and protection mechanisms. To be effective and functional, they must be processed on incoming requests before the API Management gateway contacts the backend service. Therefore, both policies must be placed in the inbound section of the policy document.
Step-by-Step Solution
Key Concept
API Management policies are structured into sections (inbound, backend, outbound, on-error) based on when the policy should execute. Pre-processing policies like CORS and rate limiting must be placed in the inbound section.