When I configured Cors policy in Virtual service it allowing all the origins. not blocking other origins. frontend app only to be access for that added allow origin as front end endpoint.
here is my configuration file.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: site-api-vser
namespace: istio-system
spec:
hosts:
- "*"
gateways:
- app-istio-gateway
http:
- match:
- uri:
prefix: /
route:
- destination:
host: site-svc.istio-system.svc.cluster.local
port:
number: 5100
corsPolicy:
allowOrigin:
- http://x.x.x.x:32675
allowOrigins:
- exact: http://x.x.x.x:32675
allowMethods:
- POST
- GET
- PUT
- OPTIONS
- PATCH
- DELETE
allowHeaders:
- authorization
- content-type
- accept
- origin
- user-agent