Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Johan_Lång's avatar
Johan_Lång
Icon for Cirrus rankCirrus
May 05, 2021

Cors preflight requests problem

I have two different web applications that make requests to domain names other than themselves. For example, x.domain.com makes a request to y.domain.com to retrieve certain data. The user is authent...
application delivery
BIG-IP Access Policy Manager (APM)
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Jul 21, 2021

if you are using ASM it might be the culprit, check this:

 

Bug ID 746394: With ASM CORS set to 'Disabled' it strips all CORS headers in response.

 

https://cdn.f5.com/product/bugtracker/ID746394.html

 

Also if y.domain.com where your request is landing has an ASM policy in blocking mode please do check that OPTIONS method is not blocked in ASM policy (it is blocked by default)

Johan_Lång's avatar
Johan_Lång
Icon for Cirrus rankCirrus
Jul 21, 2021

Thanks for your reply, unfortunately we´re not using ASM together with APM.

/Johan