Allow CORS HEADER

 RECV

if (req.method == "OPTIONS" && req.http.Origin && (req.http.Access-Control-Request-Method || req.http.Access-Control-Request-Headers) ) { error 601; }

ERROR

if (obj.status == 601) { # Standard response to a preflight does not have a response # body, so a 204 No Content is appropriate, though you can # also send a 200 OK, that works too. set obj.status = 204; set obj.response = "No content"; if (req.http.Access-Control-Request-Headers) { set obj.http.Access-Control-Allow-Headers = req.http.Access-Control-Request-Headers; } # Echo the requested origin back to the client. You may like to # check this against an allowlist of origins instead of blindly # allowing potentially dsestructive requests from any origin set obj.http.Access-Control-Allow-Origin = req.http.Origin; # Client may use this preflight response to authorise future # requests that would otherwise also require a preflight, so # to maximise reuse, we'll list all allowed methods here, not # just the one that was requested. (think carefully before # adding 'DELETE' to this list!) set obj.http.Access-Control-Allow-Methods = "GET,HEAD,POST,OPTIONS"; # Setting a cache TTL on the response allows the client to use # this preflight response for other requests. set obj.http.Access-Control-Max-Age = "86400"; return(deliver); }

RefLink: https://www.fastly.com/documentation/solutions/examples/cors-options-preflights-at-the-edge/

RECV

if (fastly.ff.visits_this_service == 0) {
 if (req.http.host == "mcstagingace.domain.com" && req.url ~ "^/$") {
    set req.url = "/ace_stg/index.html";
 } elseif (req.http.host == "mcstagingace.domain.com" && req.url !~ "^/ace_stg") {
    set req.url = "/ace_stg" + req.url;
 }
}


if (req.method == "OPTIONS" && req.http.Origin &&
  (req.http.Access-Control-Request-Method || 
  req.http.Access-Control-Request-Headers)
) {
  error 601;
}

ERROR:

if (obj.status == 601) {
  
  # Standard response to a preflight does not have a response
  # body, so a 204 No Content is appropriate, though you can
  # also send a 200 OK, that works too.
  set obj.status = 204;
  set obj.response = "No content";
  if (req.http.Access-Control-Request-Headers) {
    set obj.http.Access-Control-Allow-Headers = req.http.Access-Control-Request-Headers;
  }

  # Echo the requested origin back to the client.  You may like to
  # check this against an allowlist of origins instead of blindly
  # allowing potentially dsestructive requests from any origin
  set obj.http.Access-Control-Allow-Origin = req.http.Origin;
 
  # Client may use this preflight response to authorise future
  # requests that would otherwise also require a preflight, so
  # to maximise reuse, we'll list all allowed methods here, not
  # just the one that was requested. (think carefully before
  # adding 'DELETE' to this list!)
  set obj.http.Access-Control-Allow-Methods = "GET,HEAD,POST,OPTIONS";
 
  # Setting a cache TTL on the response allows the client to use
  # this preflight response for other requests.
  set obj.http.Access-Control-Max-Age = "86400";
 
  return(deliver);
}