CORS issue with Azure Application Proxy

Question

CORS issue with Azure Application Proxy

Erik Andersson 1

I currently have two on-premise apps, one is the web app and the other is the API for it. Lets call them app.customdomain.com and api.customdomain.com. These work on the internal network but I want to publish them externally through the Application Proxy we have set up.

Config:

I've added these apps to the proxy using a wildcard app with the URL"https://*.customdomain.com" with 2 application segments added with URLs "https://app.customdomain.com" and "https://api.customdomain.com" and added the following CNAMe records to our external DNS:

app.customdomain.com -> `

Sridevi Machavarapu 22,525 Reputation points Microsoft External Staff Moderator

2026-03-12T16:58:29.0966667+00:00
Hello Erik Andersson,

This behavior is expected when using Microsoft Entra Application Proxy. Application Proxy forwards requests to the backend application and does not modify or add CORS headers. These headers must be returned by the API itself.

In your scenario, the web app (https://app.customdomain.com) calls the API (https://api.customdomain.com). Browsers treat these as different origins, so the API must explicitly allow requests from the web app.

Please check the API configuration and ensure it returns headers similar to:

Access-Control-Allow-Origin: https://app.customdomain.com Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization

Also confirm that the API handles OPTIONS (preflight) requests. If the server blocks or does not respond to OPTIONS, the browser will block the request.

You can verify the response headers by accessing https://api.customdomain.com and checking them using browser developer tools or tools such as curl/Postman.

If the request works internally but fails externally, review the backend web server configuration (for example IIS, Nginx, or Apache) to ensure the CORS headers are returned through the proxy.

For more details, see the Microsoft documentation: https://learn.microsoft.com/entra/identity/app-proxy/application-proxy-understand-cors-issues

Hope this helps.