Deploy to new Azure Container Apps Express

[appscontrol]

Hi there,

Is it possible to deploy DAB to the new Express version of Container Apps? This would be ideal as with it's consumption pricing and very fast startup times it be a great platform for DAB especially where costs are tight (we're a charity).

Best regards,

Derek

[aaronburtle]

Hi Derek,

Yes, DAB is technically compatible with Azure Container Apps Express. DAB runs as a standard Linux/AMD64 HTTP container on port 5000, which matches the workloads supported by Express.

The deployment would follow the existing DAB Container Apps guidance: build a small custom image based on the official DAB image, include the DAB configuration, supply the database connection through a secret-backed environment variable, and configure HTTP ingress for target port 5000.

Please be aware that Express is currently in preview. Some resources you may find useful:

https://learn.microsoft.com/en-us/azure/container-apps/express-overview

https://learn.microsoft.com/en-us/azure/container-apps/express-faq

[appscontrol]

*** Please ignore this post *** - some how (?) all working fine in Express now 👍

Hi aaronburtle,

Just thought I'd let you know I've tried a setup of DAB in Express but after a couple of days of trying various things (with ChatGPT help) I've been unable to get it working. I don't think it's a DAB issue at all (using exact same container image which works in Container App but doesn't in Container App Express) and I think it's an Express issue which being in preview is likely.

But I thought you or others might find the (AI generated) summary of the issue useful to see in case it triggers a thought or for others trying Express with DAB

Here's the issue summary ...

Title
Azure Container Apps Express ingress rejects CORS preflight requests containing Access-Control-Request-Headers
Summary
I have found what appears to be a CORS bug in the ingress layer of Azure Container Apps Express.
A Container App Express deployment correctly handles an OPTIONS preflight request when no Access-Control-Request-Headers header is present, returning 204 No Content.
However, when the preflight includes Access-Control-Request-Headers, the Express ingress returns:
HTTP/1.1 403 Forbidden
Content-Type: application/json; charset=utf-8

{"error":"CORS preflight headers denied","errorCode":"InvalidRequest"}
This occurs even when the requested headers are explicitly configured as allowed headers.
Environment
• Azure Container Apps Express
• Region: West US 2
• Container App: dabexp01
• Resource group: rfsresgrp06
• Azure CLI: 2.88.0
• Container image: rfsacr01.azurecr.io/dab-clean:v1.2.0
• Application: Microsoft Data API Builder 2.0.9
• Ingress: HTTP
• Origin making the request: https://localhost:7163
The container itself is healthy and responds normally. The application is Data API Builder, but the problem appears to occur at the Express ingress layer before the application can handle the CORS preflight.
CORS configuration
The Express CORS configuration is:
{
"allowCredentials": false,
"allowedHeaders": [
"authorization",
"content-type"
],
"allowedMethods": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE",
"OPTIONS"
],
"allowedOrigins": [
"*"
],
"exposeHeaders": null,
"maxAge": 0
}
This was confirmed using:
az containerapp ingress cors show
--name dabexp01
--resource-group rfsresgrp06
Reproduction
A preflight without requested headers succeeds:
curl --http1.1 -i -X OPTIONS
'https://dabexp01.ambitiousglacier-6907380f.westus2.azurecontainerapps.io/'
-H 'Origin: https://localhost:7163'
-H 'Access-Control-Request-Method: GET'
Result:
HTTP/1.1 204 No Content
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 0
However, adding a requested header causes the request to fail:
curl --http1.1 -i -X OPTIONS
'https://dabexp01.ambitiousglacier-6907380f.westus2.azurecontainerapps.io/'
-H 'Origin: https://localhost:7163'
-H 'Access-Control-Request-Method: GET'
-H 'Access-Control-Request-Headers: content-type'
Result:
HTTP/1.1 403 Forbidden
Content-Type: application/json; charset=utf-8

{"error":"CORS preflight headers denied","errorCode":"InvalidRequest"}
The same happens with:
Access-Control-Request-Headers: authorization
It also happens when both headers are explicitly configured as allowed headers.
Additional evidence
Initially, the Express CORS configuration had:
allowedHeaders: [""]
allowedMethods: []
allowedOrigins: [""]
With this configuration, the preflight was rejected with:
CORS preflight method denied
After explicitly adding OPTIONS and the other methods:
allowedMethods:
GET
POST
PUT
PATCH
DELETE
OPTIONS
the error changed to:
CORS preflight headers denied
This suggests that the Express ingress is processing the CORS policy and specifically rejecting the Access-Control-Request-Headers portion of the preflight.
Control test – standard Azure Container Apps
The exact same Data API Builder container image and configuration works correctly when deployed as a standard Azure Container App.
The standard Container App returns:
HTTP/1.1 200 OK
access-control-allow-origin: https://localhost:7163
access-control-allow-headers: authorization
access-control-max-age: 0
for the equivalent preflight request containing:
Origin: https://localhost:7163
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Therefore the application/DAB configuration is not the cause.
The same image and application configuration work in standard Container Apps but fail in Container Apps Express.
Expected behaviour
If the configured CORS policy contains:
allowedHeaders: ["authorization", "content-type"]
then a preflight requesting:
Access-Control-Request-Headers: authorization
or:
Access-Control-Request-Headers: content-type
should be accepted and return an appropriate successful preflight response.
The Microsoft Container Apps documentation describes allowedHeaders as controlling the headers allowed in cross-origin requests, and supports * as a value.
Actual behaviour
Container Apps Express returns:
403 CORS preflight headers denied
for any preflight containing Access-Control-Request-Headers, even when the requested header is explicitly included in the Express CORS configuration.
Impact
This prevents browser-based applications from making normal authenticated cross-origin API requests through Container Apps Express.
In particular, APIs requiring an Authorization request header cannot be consumed by a browser application hosted on a different origin.
Request
Please confirm whether this is a known limitation/bug in the Azure Container Apps Express ingress CORS implementation.
If it is a bug, please provide the tracking issue/fix status and an expected workaround.
If it is expected behaviour, please clarify how an Express-hosted API is intended to support browser CORS preflight requests containing non-safelisted request headers such as Authorization.