1. On the Main tab, click Security > Application Security > URLs .
   The Allowed HTTP URLs screen opens.
2. In the Current edited security policy list near the top of the screen, verify that the security policy shown is the one you want to work on.
3. Locate the HTTP or WebSocket URL that needs CORs support:
   1. From the Allowed URLs menu, choose either Allowed HTTP URLs or Allowed WebSocket URLs.
   2. In either the Allowed URLs List or the Allowed WebSocket URLs List, click the URL you want to modify.
   The Allowed HTTP URL Properties screen or WebSocket URL Properties screen for the URL opens.
4. From either URL Properties list, select Advanced.
5. Click the HTML5 Cross-Domain Request Enforcement tab.
6. For Enforcement Mode, specify the option to determine how to handle CORS requests.

   Select this option	To do this
   Disabled	Do nothing related to cross-domain requests. Pass CORS requests exactly as set by the server.
   Remove all CORS headers	Remove all CORS headers from the response. The response is sent to the browser, and the browser does not allow cross-origin requests.
   Replace CORS headers (HTTP URLs only)	Replace the CORS header in the response with another header specified on the tab, including allowed origins, allowed methods, allowed headers, and so on. The browser enforces the policy. Then after Replace with specify the protocol, origin, and port for replacing CORS headers.
   Enforce on ASM	Allow cross-origin resource sharing as configured in the Allowed Origins setting. CORS requests are allowed from the domains specified as allowed origins. ASM enforces the policy. Specify the protocol, origin, and port of allowed origins

   For maximum security, F5 recommends that you select Enforce on ASM.
   The tab now includes additional settings determined by the option you selected.
7. For the Allowed Origins setting, add the origins that are allowed to share data returned by this URL.
   1. For Protocol, select the appropriate protocol for the allowed origin.
   2. For Origin Name, type the domain name or IP address with which the URL can share data.
      Wildcards are allowed in the names. For example: *.f5.com will match b.f5.com; however it will not match a.b.f5.com.
   3. For Port, select the port that other web applications can use to request data from your web application, or use the * wildcard for all ports.
   4. If you want to allow sub-domains to receive data, select the Include Sub-Domains check box.
   5. Click Add to add the origins.
      The origins that can share data with the URL are included in the list.
8. Click Update.
9. To put the security policy changes into effect immediately, click Apply Policy.

1. On the Main tab, click Security > Application Security > URLs .
   The Allowed HTTP URLs screen opens.
2. In the Current edited security policy list near the top of the screen, verify that the security policy shown is the one you want to work on.
3. From the Allowed HTTP URLs List, click the name of the URL you want to modify.
   The Allowed HTTP URL Properties screen opens.
4. From the Allowed URL Properties list, select Advanced.
5. On the HTML5 Cross-Domain Request Enforcement tab, for Enforcement Mode, select Replace CORS headers.
   The tab now includes additional settings where you define how to overwrite CORS response headers returned by the web server.
6. In the Allowed Origins setting, add the origins that are allowed to share data returned by this URL.
   Select Replace with, then specify the origin names:
   1. For Protocol, select the appropriate protocol for the allowed origin.
   2. For Origin Name, type the domain name or IP address that you want to allow to share your data with.
      Wildcards are allowed in the names. For example: *.f5.com will match b.f5.com, but it will not match a.b.f5.com.
   3. For Port, select the port that other web applications can use to request data from your web application, or use the * wildcard for all ports.
   4. If you want to allow sub-domains to receive data, select the Include Sub-Domains check box.
   5. Click Add to add the origins.
      The origins that can share data with the URL are included in the list.
7. Optionally, for Allowed Methods, specify which methods other applications may use when requesting this URL from another domain. Select Replace with, then move the methods to allow from the Available Methods to the Allowed Methods list.
   Important: Any method you allow here must also be in the Allowed Methods list in the security policy ( Security > Application Security > Headers > Methods ).
8. Optionally, for Allowed Headers, select Replace with, then type the headers that other applications can use when requesting this URL from another domain.
   Allowed headers are request headers sent by clients. For example, to allow clients to send Ajax requests, type X-Requested-With, and to allow XML requests, type Content-Type.
9. Optionally, for Exposed Headers, select Replace with, then specify the headers that JavaScript can expose and share with other applications when requesting this URL from another domain.
   Exposed headers are the headers the server returns in the response. For example, to discover server side web application technology, type X-Powered-By.
10. Optionally, for Allow Credentials, select Replace with, then specify whether requests from applications in another domain can include user credentials.
11. Optionally, for Maximum Age, select Replace with, then specify the number of seconds that the results of a preflight request can be cached or use the default.
12. Click Update.
13. To add methods, such as OPTIONS, required to replace headers:
    1. Click Security > Application Security > Headers > Methods .
    2. Click Create.
    3. In the Method setting, select OPTIONS.
    4. Click Create.
14. To put the security policy changes into effect immediately, click Apply Policy.

If you enable cross-domain request enforcement, the system must authorize requests (typically AJAX requests) made from one domain to another. When a client makes a request to another origin, the browser sends a preflight request to determine whether JavaScript from another domain may access your resource.

When processing a modification request, the browser sends a preflight request if it has no previously cached allowed origins (that is, this is the first time the browser goes to the foreign domain for such requests). The preflight request uses an OPTIONS HTTP method and CORS-related headers to check whether the server authorizes that origin.

The CORS-related headers that are included in a preflight request are:

In response to the preflight request, the system uses these CORS response headers:

The browser uses the response to determine whether to allow the JavaScript to make the actual request. If the cross-domain request is authorized, the server processes the actual requests by rechecking the origin and including another response header:

The browser then allows the foreign domain to send its original requests.

If you do not enable cross-domain request enforcement, the system removes all cross-origin request headers and CORS is not allowed for the URL.

If you select Enforce on ASM as the CORS Enforcement Mode, ASM™ permits access according to the allowed origins. So, when using this option, there is no need for a preflight request because ASM itself checks the origin. Unlike using the Replace CORS headers setting, ASM, not the browser, does the enforcement.