In issue #1 we added the ability to make cross domain posts but now we'd like to make this more secure by making posts available to a single domain.

This can be achieved by changing the property in the web section of the arm template from:

"cors": {
              "allowedOrigins": [
                "*"
              ]
            }

to:

"cors": {
              "allowedOrigins": [
                "http://yourdomain.com"
              ]
            }

The domain should be taken from a parameter filled out by the user upon deployment setup.

All resources within the arm template react well to using this value for the location property

"[resourceGroup().location]"

except the storage resource.

After a bit of research I came across this SO answer https://stackoverflow.com/a/42502687/526737 which turned out to be correct. There are some locations for example UK South that do not revolve to something the resource can use. This looks to be an issue on Microsoft's side.

To re-create issue:

• deploy arm template to a resource group based in location "UK South"

OS: Windows 10
Browser: Chrome 63.0.3239.84

What happened?
Deployed AzContactForm. Used the demo to post a message but the service responded with a "400 Bad Request" status code. The request was also marked as using the OPTIONS verb rather than POST. It looks like the browser has intercepted and re-configured the request.

This looks like a CORS issue.