Configure URL Rewrite using server variable to support multiple origins
<p>I was dealing with CORS issue a couple days ago where I need to support multiple origins. I did some research and found a couple posts pointing me to this great tool (URL Rewrite). I got the solution I wanted following Paco Zarate tip here: <a href="https://stackoverflow.com/questions/17323350/access-control-allow-origin-with-multiple-domains">Access-control-allow-origin with multiple domains</a> using URL Rewrite. I also found another post here: <a href="http://www.carlosag.net/articles/enable-cors-access-control-allow-origin.cshtml" rel="nofollow noreferrer">http://www.carlosag.net/articles/enable-cors-access-control-allow-origin.cshtml</a> showing me how to achieve the same solution with a different method of configuration within URL Rewrite.</p>

<p>Paco Zarate solution works like a charm. Why am I still asking question? It's just for learning purposes. And also I think the second post configuration yields a more elegant list of origins/domains I want to white-listed. For ease of maintainability I can just go to the Rewrite Maps and see all of my AllowedOrigins.</p>

<p>When attempted the second post's solution, I got this message: ERR_CONNECTION_RESET under Console tab of the browser debugger tool. And the request header under Network tab says "Provisional headers are shown"</p>

<p>Many thanks in advance. </p>

<p>My config file:</p>

<pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;configuration&gt;
&lt;system.webServer&gt;
    &lt;httpErrors errorMode="Detailed" /&gt;
    &lt;urlCompression doStaticCompression="true" doDynamicCompression="true" /&gt;
    &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
            &lt;add name="Access-Control-Allow-Headers" value="Origin, Content-Type, Accept" /&gt;
            &lt;add name="Access-Control-Request-Method" value="POST" /&gt;
            &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
            &lt;add name="Access-Control-Allow-Origin" value="http://localhost:8080" /&gt;
        &lt;/customHeaders&gt;
    &lt;/httpProtocol&gt;
    &lt;rewrite&gt;
        &lt;rules&gt;
            &lt;rule name="Capture Origin Header"&gt; 
        &lt;match url=".*" /&gt; 
        &lt;conditions&gt;
                    &lt;add input="{HTTP_ORIGIN}" pattern=".+" /&gt; 
        &lt;/conditions&gt; 
        &lt;serverVariables&gt;
                    &lt;set name="CAPTURED_ORIGIN" value="{C:0}" /&gt; 
        &lt;/serverVariables&gt; 
        &lt;action type="None" /&gt; 
        &lt;/rule&gt;
            &lt;rule name="Preflight Options" enabled="false" stopProcessing="true"&gt;
                &lt;match url=".*" /&gt;
                &lt;conditions&gt;
                    &lt;add input="{REQUEST_METHOD}" pattern="^OPTIONS$" /&gt;
                &lt;/conditions&gt;
                &lt;action type="CustomResponse" statusCode="200" statusReason="Preflight" statusDescription="Preflight" /&gt;
            &lt;/rule&gt;
        &lt;/rules&gt;
        &lt;rewriteMaps&gt;
            &lt;rewriteMap name="AllowedOrigins"&gt;
                &lt;add key="http://somedomain:8080" value="http://localhost:8080" /&gt;
            &lt;/rewriteMap&gt;
        &lt;/rewriteMaps&gt;
         &lt;outboundRules&gt; 
            &lt;rule name="Set-Access-Control-Allow-Origin for known origins"&gt; 
                &lt;match serverVariable="RESPONSE_Access-Control-Allow-Origin" pattern=".+" negate="true" /&gt; 
                &lt;conditions&gt; 
                    &lt;add input="{AllowedOrigins:{CAPTURED_ORIGIN}}" pattern=".+" /&gt; 
                &lt;/conditions&gt; 
                &lt;action type="Rewrite" value="{C:0}" /&gt; 
            &lt;/rule&gt; 
        &lt;/outboundRules&gt; 
    &lt;/rewrite&gt;
    &lt;tracing&gt;
        &lt;traceFailedRequests&gt;
            &lt;add path="*"&gt;
                &lt;traceAreas&gt;
                    &lt;add provider="WWW Server" areas="Rewrite" verbosity="Verbose" /&gt;
                &lt;/traceAreas&gt;
                &lt;failureDefinitions timeTaken="00:00:00" statusCodes="500" verbosity="Error" /&gt;
            &lt;/add&gt;
        &lt;/traceFailedRequests&gt;
    &lt;/tracing&gt;
&lt;/system.webServer&gt;
</code></pre>

<p></p>