---
id: 3641470c-ac40-4ae7-b071-ef8d00af5bfb
---

# Azure Web App CORS Issue
---

Cross-Origin Resource Sharing (CORS) issues can occur when a web application tries to make requests to a different domain than the one it originated from. This can lead to unexpected behavior, security errors, or blocked API calls. CORS issues can prevent web pages from functioning properly and can be a common issue for web developers and software engineers.

### Parameters
```shell
export WEB_APP_NAME="PLACEHOLDER"

export RESOURCE_GROUP_NAME="PLACEHOLDER"

export CERTIFICATE_NAME="PLACEHOLDER"

export NSG_NAME="PLACEHOLDER"

export NSG_RULE_NAME="PLACEHOLDER"

export CLIENT_DOMAIN="PLACEHOLDER"
```

## Debug

### Check if the web app is running
```shell
az webapp show --name ${WEB_APP_NAME} --resource-group ${RESOURCE_GROUP_NAME} --query state
```

### Check if the web app's logs reveal any CORS-related errors
```shell
az webapp log tail --name ${WEB_APP_NAME} --resource-group ${RESOURCE_GROUP_NAME} 
```

### Check if the web app's SSL certificate is valid and installed correctly
```shell
az webapp config ssl show --certificate-name ${CERTIFICATE_NAME} --resource-group ${RESOURCE_GROUP_NAME}
```

### Check if the web app's network traffic is being blocked by a firewall
```shell
az network nsg rule show --resource-group ${RESOURCE_GROUP_NAME} --nsg-name ${NSG_NAME} --name ${NSG_RULE_NAME}
```

### Check if CORS is enabled on the web app
```shell
az webapp cors show --name ${WEB_APP_NAME} --resource-group ${RESOURCE_GROUP_NAME}
```

## Repair

### Update and ensure that the correct headers are being set. Specifically, the Access-Control-Allow-Origin header should be set to allow requests from the client's domain.
```shell
bash

#!/bin/bash



# Set variables

resource_group=${RESOURCE_GROUP_NAME}

webapp_name=${WEB_APP_NAME}

client_domain=${CLIENT_DOMAIN}



# Get the current CORS settings for the web app

cors_settings=$(az webapp cors show -g $resource_group -n $webapp_name --output json)



# Check if the Access-Control-Allow-Origin header is set correctly

if [ -n "$(echo "$cors_settings" | grep -E 'allowedOrigins":\s*\[')" ]; then

  echo "Access-Control-Allow-Origin header is set correctly."

else

# Set the Access-Control-Allow-Origin header to allow requests from the client's domain

  az webapp cors add -g $resource_group -n $webapp_name --allowed-origins $client_domain

  echo "Access-Control-Allow-Origin header has been updated."

fi


```

Cross-Origin Resource Sharing (CORS) issues can occur when a web application tries to make requests to a different domain than the one it originated from. This can lead to unexpected behavior, security errors, or blocked API calls. CORS issues can prevent web pages from functioning properly and can be a common issue for web developers and software engineers.


```shell
export WEB_APP_NAME="PLACEHOLDER"

export RESOURCE_GROUP_NAME="PLACEHOLDER"

export CERTIFICATE_NAME="PLACEHOLDER"

export NSG_NAME="PLACEHOLDER"

export NSG_RULE_NAME="PLACEHOLDER"

export CLIENT_DOMAIN="PLACEHOLDER"
```


### Check if the web app is running

```shell
az webapp show --name ${WEB_APP_NAME} --resource-group ${RESOURCE_GROUP_NAME} --query state
```

### Check if the web app's logs reveal any CORS-related errors

```shell
az webapp log tail --name ${WEB_APP_NAME} --resource-group ${RESOURCE_GROUP_NAME} 
```

### Check if the web app's SSL certificate is valid and installed correctly

```shell
az webapp config ssl show --certificate-name ${CERTIFICATE_NAME} --resource-group ${RESOURCE_GROUP_NAME}
```

### Check if the web app's network traffic is being blocked by a firewall

```shell
az network nsg rule show --resource-group ${RESOURCE_GROUP_NAME} --nsg-name ${NSG_NAME} --name ${NSG_RULE_NAME}
```

### Check if CORS is enabled on the web app

```shell
az webapp cors show --name ${WEB_APP_NAME} --resource-group ${RESOURCE_GROUP_NAME}
```


### Update and ensure that the correct headers are being set. Specifically, the Access-Control-Allow-Origin header should be set to allow requests from the client's domain.

```shell
bash

#!/bin/bash



# Set variables

resource_group=${RESOURCE_GROUP_NAME}

webapp_name=${WEB_APP_NAME}

client_domain=${CLIENT_DOMAIN}



# Get the current CORS settings for the web app

cors_settings=$(az webapp cors show -g $resource_group -n $webapp_name --output json)



# Check if the Access-Control-Allow-Origin header is set correctly

if [ -n "$(echo "$cors_settings" | grep -E 'allowedOrigins":\s*\[')" ]; then

  echo "Access-Control-Allow-Origin header is set correctly."

else

# Set the Access-Control-Allow-Origin header to allow requests from the client's domain

  az webapp cors add -g $resource_group -n $webapp_name --allowed-origins $client_domain

  echo "Access-Control-Allow-Origin header has been updated."

fi


```


Azure Web App CORS Issue

Overview

Parameters

Debug

Check if the web app is running

Check if the web app's SSL certificate is valid and installed correctly

Check if the web app's network traffic is being blocked by a firewall

Check if CORS is enabled on the web app

Repair

Update and ensure that the correct headers are being set. Specifically, the Access-Control-Allow-Origin header should be set to allow requests from the client's domain.

Learn more

Related Runbooks

Support