Azure Functions suddenly throwing CORS errors when ran locally? Easy fix(es)!

Time needed: 10 minutes

How to (maybe) fix your local Azure Functions CORS configuration?

1. Verify your CORS origins

   Okay, okay – sounds super basic, but maybe you have an issue in your CORS settings. So let’s verify the following:
   – You have either the URLs of the sites hosting your front-end code OR an asterisk (“*”) in the value
   – The URLs don’t end in a slash (“/”)
   – The URLs are separated by a comma (“,”)
   – The protocols of the URLs match (http vs https)
   
   All good? You’ll probably have “CORS”:”*” set for local development, but for Azure Functions configuration, you should have something like this:
   
   "http://localhost:7071,https://azure-samples.github.io,https://localhost:44343,https://localhost:44364"
2. Disable sending CORS credentials

   This should be false by default, but it seems to me that the Azure Functions CLI sometimes has trouble remembering the default values :) I don’t know what kind of internal magic this invokes, but setting the CORSCredentials key to false has removed the issue for me once or twice.
   
   But what does the setting do? When enabled – set to true – it enables you to send authentication details – headers, cookies, certificates – in the cross-domain requests you perform. I’ve needed this, for example, to authenticate against a SignalR hub from the front end.
   
   This should look somewhat like the below in the local.settings.json file:
   {
"IsEncrypted": false,
"Host": {
"CORSCredentials": false
},
"Values": {
}
}

3. Debug instead of running from the CLI

   If you’re not doing this already, try running the Azure Functions CLI as part of debugging your solution, and make sure you’re running it with DEBUG configuration!

4. Take another look at the actual URL you’re calling…

   I’ve been bitten by this a couple of times now.
   
   It sounds super basic, but you might just be calling the wrong address and the CORS error might just be something that gets thrown before you’d get a 404 (which would definitely be less confusing).