Display CORS content in an explicit proxy environment

Webpages can display Cross-Origin Resource Sharing (CORS) content in an explicit proxy environment when using session-based, cookie-enabled, and captive portal assisted authentication. This ensures that webpages are displayed correctly and improves the user experience.

config authentication rule
    edit <name>
        set web-auth-cookie enable
        set cors-stateful {enable | disable}
        set cors-depth <integer>
    next
end

cors-stateful {enable | disable}	Enable/disable allowing CORS access (default = disable). This setting is only available when web-auth-cookie is enabled.
cors-depth <integer>	Set the depth to allow CORS access (1 - 8, default = 3). For example, when visiting domain A, the returned web page may refer the browser to a cross-origin domain B (depth of 1). When the browser visits domain B, the returned web content may further refer the browser to another cross-origin domain C (depth of 2).

Example

CORS access is enabled in this example. When a user access the Microsoft Sign in page using an explicit proxy, the page appears and the user can log in. This example assumes the web proxy and user group have already been configured, and that the proxy captive portal setting has been enabled on the appropriate interface.

To view CORS content in an explicit proxy environment:

1. Configure the authentication scheme:

   config authentication scheme
       edit "form"
           set method form
           set user-database "local-user-db"
       next
   end

2. Configure the authentication rule:

   config authentication rule
       edit "form"
           set srcaddr "all"
           set ip-based disable
           set active-auth-method "form"
           set web-auth-cookie enable
           set cors-stateful enable
           set cors-depth 3
       next
   end

3. Configure the captive portal:

   config authentication setting
       set captive-portal "fgt9.myqalab.local"
   end

4. Configure the proxy policy:

   config firewall proxy-policy
       edit 1
           set proxy explicit-web
           set dstintf "port9"
           set srcaddr "all"
           set dstaddr "all"
           set service "webproxy"
           set action accept
           set schedule "always"
           set logtraffic all
           set groups "localgroup"
           set utm-status enable
           set ssl-ssh-profile "deep-custom"
           set av-profile "av"
       next
   end

5. Get a user to access login.microsoftonline.com trough the explicit web proxy. The Sign in page appears, and the user can log in.

   

   If CORS access (cors-stateful) was disabled, the browser would load a blank page.