CORS Failing in IE when passing 3 headers

[Ashutosh Singh]

I have HTTP GET/POST request where I need to pass 2 headers ( id and secret).Whenever I am trying access this resource from IE, it always fail with error message 

SEC7123: Request header secret was not present in the Access-Control-Allow-Headers list.

However this works perfectly fine when I am trying access from Mozilla/Chrome. Also if I pass only one header in place of 2, this request goes through.

 

headers: {

                                                  'Content-Type':'application/x-www-form-urlencoded',

                                                  'Id': '**************************',                  

                                                  'Secret':'428******723989'

                                      }

 

Can somebody help us ?

[Ashutosh Singh]

Any body has got any idea on this issue ? Really appreciate is somebody can help me here...

[mvebe]

I've been messing with this issue also and we've found a fix for it.

CA API gateway will be returning multiple headers of Access-Control-Allow-Headers.

IE will only process the first one, throwing an error when you're expecting multiple values as you described.

 

Here's the fix:

[mrutherford]

This worked for me as well when I encountered the same issue. I was told by CA that they fixed this in 9.3, however I'm running 9.3 and it still seems to be an issue in IE 11. Using these assertions was the only way I could get around it. 

[ROBERTO RONCOLATO]

Found same issue with CORS and IE 11. Thanks for the info !

 

regards, Roberto 

[Mike Henry]

cors.useMultiValuedHeaders

 

Controls whether the Process CORS Request assertion uses multi-valued headers.

 

Default: false

 

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-api-management/api-gateway/9-4/policy-assertions/assertion-palette/access-control-assertions/process-cors-request-assertion.html#concept.dita_b2bd3269b77dae921baebcdc736012b76c0f628a_ClusterProperties

​