Can Akamai use the incoming request Origin header as a variable (for populating CORS Access-Control-Allow-Origin headers)?

Question

I'm setting up Akamai to handle a large number of vanity URLs that all serve the same content:

• example.com
• one.example.com
• two.example.com
• ...
• onehundred.example.com

These URLs all retrieve static assets from static.example.com, which is currently getting a 403 due to CORS not being configured.

In my Akamai property I'm trying to set a rule that matches the request's Origin header against whitelist of my vanity URLs, and then echoes back the Origin header value in the response's Access-Control-Allow-Origin header.

But... In the value field for the response header I haven't been able to find a way to use the Origin header value as a variable. Is that possible? If not, is there an alternative approach to do this without having to add a CORS Rule for every single hostname?

Answer 1

The simplest way I can think of to do this is with two rules, using Property Variables in your Property. Start by creating a Property Variable. I made one here called PMUSER_ORIGIN.

The first rule will always match and extract the Origin header to store as a variable, like so:

The second rule will match the newly set variable against your whitelisted domains, and then modify any outbound Response headers to include the correct CORS header, like so:

I use the "Modify" action instead of "Add" as it's actually a two-step process.

1. Remove existing header.
2. Add new header.

It results in a slightly cleaner response.