CORS policies headers fail

[murhaforarticle]

Hi everyone,

I've got a problem.

I would like to use Apigee Spec swagger, but it produced "Access to fetch at 'https://xxx' from origin 'https://apigee.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled." error.

I adjusted my endpoints as it was defined there https://docs.apigee.com/api-platform/develop/adding-cors-support-api-proxy

I created standard policy:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="add-cors">
<DisplayName>Add CORS</DisplayName>
<FaultRules/> 
<Properties/> 
<Set>
	<Headers>
		<Header name="Access-Control-Allow-Origin">*</Header>
		<Header name="Access-Control-Allow-Headers">origin, x-requested-with, accept, content-type, authorization</Header>
		<Header name="Access-Control-Max-Age">3628800</Header>
		<Header name="Access-Control-Allow-Methods">GET, PUT, POST, DELETE</Header>
	</Headers> 
</Set> 
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
<AssignTo createNew="false" transport="http" type="response"/> 
</AssignMessage>

and put it in all flows and in requests and responses sections.

It does not have any effect.

I do not have this headers on response:

Which could be a season of that?

Thank you!

[murhaforarticle · Accepted solution]

Seems, I have found something.

Swagger UI in APIs Specs sends "Authorization: BearerToken ..." instead on "Authorization: Bearer ..."

Token check fails and error response is returned back to the browser without of CORS headers.

Trying to overcome that.

Seems its Apigee Swagger issue