Getting Error 403 with Front End Azure Web App using App Gateway

I have configured App Gateway and the backend of my App Gateway has two apps, one Front End Web App and another Function App.
The function app is talking to a Databricks instance from another tenant and getting data.
I have an API app that is sitting between my Front End and Function App.

After doing custom domain name binding for both my FE and Function App and making the custom domain name same as the App GW Https listeners, i get rerouted to the Front End web app when i try to browse to the Front End App via App Gateway.

But i get to see this error in the browser after i hit F12.
In the API web app i have CORS enabled and the URL mentioned is that of the custom domain of the FE web app.
Any idea why this error is coming still

Request URL: https://contoso-qa-8234.azurewebsites.net/datahub/negotiate
Request Method: OPTIONS
Status Code: 403
Remote Address: 20.X.X.X:443
Referrer Policy: strict-origin-when-cross-origin

It says initiator is "Preflight" in red in the F12 window

The remote address IP is that of the IP that i see for the Front End Web App when i go to Custom Domain in App Services

Solution of the problem

you can try this
This error comes either

• When the public access is not allowed on Azure App Service, if you have open public API.


• The IP of your application with which you are calling the app service is not whitelisted.


• If you have any gateway in between then that may also be blocking your calls.

Solutions to try:

• Try removing the access restrictions from Networking page of your web app.

• Try giving the access to all by adding 0.0.0.0/0. Later you can add restrictions based on your requirements.

• The sequence of the restrictions matters, so please check that once. If you have any blocked call before any allowed call, then it may impact.

• You can also have restrictions based on http-headers like X-Forwarded-For. Please check that once. This can happen from code as well, based on how you handle the errors. Link




• If your API is behind the Gateway, then you can check this: Application Gateway integration with service endpoints