I have created a function app and secured it using AAD. I want to call a azure function under it by making a rest call to this function.

How can i achieve it? I have tried using regular Ajax rest approach but i am getting CORS error in that.

    url: serviceURL,
    type: "GET",
    xhrFields: {
      withCredentials: true

    crossDomain: true,
    success: function (data) {
      alert("Success: " + data);
    error: function (ex) {
      alert("Failure getting user token");

Please help.


If you want to use "withCredentials" feature and azure functions together, you should provide CORS for Azure Function manually.

You should:

  1. Remove all Allowed origins from CORS settings at the portal - this step is very important.
  2. You should control CORS settings from your function. Something like that:

    var response = new HttpResponseMessage(HttpStatusCode.OK) { Content = new StringContent(JsonConvert.SerializeObject(clients), Encoding.UTF8, "application/json") }; response.Headers.Add("Access-Control-Allow-Credentials", "true"); response.Headers.Add("Access-Control-Allow-Origin", "https://your-org.sharepoint.com"); response.Headers.Add("Access-Control-Allow-Methods", "GET,POST,OPTIONS");

In the past I've created a post on that topic. Please take a note on this cautions:

  • HTTP POST doesn't work in case of Azure Functions configured with EasyAuth. HTTP PUT also seems doesn't work, it sends unnecessary 302 redirect, that's why request fails. I haven't found a way to make it work. Thus I conclude that you can't use Azure Functions with EasyAuth and credentials auth with HTTP POST or PUT requests. This is a huge limitation if you want to use Azure Functions as your API backend. The workaround would be using regular Azure Web App and implementing authentication on your own. Read a separate article about this approach [link to be added].

  • because of iframe nature, you might have issues with IE security zones

  • you can’t provide wildcard (*) in CORS setup and you can’t provide multiple domains – only one allow-origin domain is possible

| improve this answer | |

You have add your site under Function App -> Platform Features -> CORS. This will allow cross domain calls.

enter image description here

And also watch the video from 27:00 for the steps.

| improve this answer | |
  • Have already added but getting below error:Access to XMLHttpRequest at 'FunctionURL' from origin 'OriginURL' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute. – Deepmala Nov 20 '18 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.