Examkin

Question

Difficulty: Very hardDefine API Management Policies

You are developing a solution in Azure API Management (APIM). The API must allow cross-origin requests from a web client hosted at `https://portal.contoso.com`. You configure JSON Web Token (JWT) validation and response caching. During testing, the web client fails to access the API, throwing a CORS error in the browser console. The APIM gateway logs show that preflight `OPTIONS` requests are failing with an HTTP `401 Unauthorized` status code. You review the following policy configuration:

xml
<policies>
<inbound>
<base />
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized">
<openid-config url="https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration" />
<required-claims>
<claim name="aud">
<value>api://portal-backend</value>
</claim>
</required-claims>
</validate-jwt>
<cors allow-credentials="true">
<allowed-origins>
<origin>https://portal.contoso.com</origin>
</allowed-origins>
<allowed-methods>
<value>GET</value>
<value>POST</value>
</allowed-methods>
</cors>
<cache-lookup vary-by-developer="false" vary-by-developer-groups="false" downstream-caching-type="none">
<vary-by-query-parameter>id</vary-by-query-parameter>
</cache-lookup>
</inbound>
<backend>
<base />
</backend>
<outbound>
<base />
<cache-store duration="60" />
</outbound>
<on-error>
<base />
</on-error>
</policies>

Which change should you apply to the policy configuration to resolve the CORS error?

  1. A
    Move the CORS policy from the inbound section to the outbound section.
  2. B
    Configure the APIM instance to use a user-assigned managed identity to authorize the CORS origin dynamically through a Key Vault reference.
  3. Move the CORS policy so that it is defined before the JWT validation policy within the inbound element.Answer
  4. D
    Store the client credentials in Azure Key Vault and configure a Key Vault access policy to allow the APIM gateway to bypass JWT validation for the OPTIONS HTTP method.

Answer

Move the CORS policy so that it is defined before the JWT validation policy within the inbound element.
Moving the CORS policy to precede the JWT validation policy is the correct solution. Because Azure API Management processes inbound policies sequentially, placing JWT validation first forces the incoming preflight OPTIONS requests to be evaluated for a JWT. Since preflight requests do not carry the Authorization header, this leads to a 401 Unauthorized response before the CORS headers are returned. Moving CORS to the top of the inbound section enables the gateway to handle the OPTIONS request and return the required headers immediately.

Step-by-Step Solution

1
Analyze the failed preflight requests
CORS preflight OPTIONS requests do not carry the Authorization header and fail with HTTP 401 Unauthorized.
Before making cross-origin requests, modern web browsers send a preflight OPTIONS request. Because it lacks credentials, it fails if forced to go through validation first.
2
Examine the policy order of execution in the inbound section
The validate-jwt policy is configured before the cors policy.
Azure API Management processes policies sequentially from top to bottom within the inbound section.
3
Determine the necessary rearrangement
The cors policy must execute before validate-jwt so it can intercept and handle the OPTIONS preflight request.
By placing CORS first, APIM returns the required Access-Control-Allow-* headers directly to the browser for OPTIONS requests before JWT validation occurs.

Key Concept

API Management policy execution order and CORS preflight handling
Rate this question

Topics

Define API Management Policies

More questions from this topic