title: Azure API Management CORS: Why do I get "Headers starting with 'Access-Control-' were removed..."
body: <p>With a simple policy below:</p>
  
  <pre><code>&lt;policies&gt;
      &lt;inbound&gt;
          &lt;cors&gt;
              &lt;allowed-origins&gt;
                  &lt;origin&gt;http://microfost.com/&lt;/origin&gt;
              &lt;/allowed-origins&gt;
              &lt;allowed-methods preflight-result-max-age="300"&gt;
                  &lt;method&gt;GET&lt;/method&gt;
                  &lt;method&gt;POST&lt;/method&gt;
                  &lt;method&gt;PATCH&lt;/method&gt;
                  &lt;method&gt;DELETE&lt;/method&gt;
              &lt;/allowed-methods&gt;
              &lt;allowed-headers&gt;
                  &lt;header&gt;content-type&lt;/header&gt;
                  &lt;header&gt;accept&lt;/header&gt;
                  &lt;header&gt;Authorization&lt;/header&gt;
              &lt;/allowed-headers&gt;
          &lt;/cors&gt;
      &lt;/inbound&gt;
  &lt;/policies&gt;  
  </code></pre>
  
  <p>HTTP request</p>
  
  <pre><code>OPTIONS https://XXXX.azure-api.net/demo/XXX/XXX/* HTTP/1.1
  Host: XXXX.azure-api.net
  Ocp-Apim-Trace: true
  Ocp-Apim-Subscription-Key: &lt;secret&gt;
  Origin: http://microfost.com
  Access-Control-Request-Headers: Authorization
  Access-Control-Request-Method: GET
  </code></pre>
  
  <p>Response content</p>
  
  <pre><code>Access-Control-Allow-Origin: http://microfost.com
  Ocp-Apim-Trace-Location: &lt;trace&gt;
  Date: Mon, 27 Feb 2017 20:09:14 GMT
  Content-Length: 0
  </code></pre>
  
  <p>I get this message and expect Origin response header I do not receive anything for 2 out of 3 APIs (1 API is working with the same policy as expected).</p>
  
  <pre><code>**Inbound**
  [...]
  cors (0 ms)
  "Cross domain request was well formed and was allowed to proceed. CORS related headers were added to the response."
  
  **Backend**
  
  No records.
  Outbound
  
  cors (0 ms)
  {
      "message": "Headers starting with 'Access-Control-' were removed from the response. ",
      "headers": []
  }
  transfer-response (0 ms)
  {
      "message": "Response headers have been sent to the caller."
  }
  </code></pre>
  
  <p>This seems to me a nonsense behavior and might be a bug. Before submitting it I would like to ask you if there is any explanation? Why do I get this?</p>
  
  <blockquote>
    <p>Headers starting with 'Access-Control-' were removed from the
    response.</p>
  </blockquote>