Access-Control-Allow-Origin on F5

Another way to approach is this (we actually have this running in prod - we have some clients for which CORS support in the server is mandatory, so we fake it);

when HTTP_REQUEST {

   if {[HTTP::method] eq "OPTIONS"} {

       HTTP::respond 200 Access-Control-Allow-Origin "[HTTP::header Origin]" \
                    Access-Control-Allow-Methods "POST, GET" \
                    Access-Control-Allow-Headers "soapaction" \
                    Access-Control-Allow-Credentials "true"
       return
  } 
}