<p>This is my requestauthentication,</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name:prod-authenticator
  namespace: prod
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: https://securetoken.google.com/&lt;project-id&gt;
    jwksUri: https://www.googleapis.com/service_accounts/v1/jwk/securetoken@system.gserviceaccount.com
</code></pre>
<p>My AuthorizationPolicy is this,</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name:prod-authorized-api
 namespace: prod
spec:
 action: ALLOW
 rules:
 - from:
   - source:
        requestPrincipals: [&quot;*&quot;]

 - to:
    - operation:
        paths: [&quot;/user/ping&quot;]
</code></pre>
<p>The below helps me to exlcude the health path (/user/ping) without valid token.</p>
<p>My Virtual Service is</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: user-svc-vs
  namespace: prod
spec:
  hosts:
  - gateway.xxxx.com
  gateways:
  - istio-system/prod-gateway
  http:
  - match:
    - uri:
        prefix: /pop
    route:
    - destination:
        host:user-svc.prod.svc.cluster.local 
</code></pre>
<p>But when checked i can see that only health api gets 200 rest all are getting 404, when checked the browser i saw that</p>
<p><strong>Access to XMLHttpRequest at 'https://' from origin 'https://&lt;&gt;' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</strong></p>
<p>In the virtual service i tried to add &quot;corsPolicy&quot; but nothing worked.</p>
<p>sample virutal service tried example is</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings-route
spec:
  hosts:
  - ratings.prod.svc.cluster.local
  http:
  - route:
    - destination:
        host: ratings.prod.svc.cluster.local
        subset: v1
    corsPolicy:
      allowOrigins:
      - exact: https://example.com
      allowMethods:
      - POST
      - GET
      allowCredentials: false
      allowHeaders:
      - X-Foo-Bar
      maxAge: &quot;24h&quot;
</code></pre>
<p>&lt;&lt;the above is not our example but i have copied but i applied with my current env but still no Luck! can any one help, struggling for the whole day on this :)</p>

<p>CORS pre-flight requests are HTTP <code>OPTIONS</code> requests which are issued by browsers automatically, see <a href="https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request" rel="nofollow noreferrer">this site for details</a>.</p>
<p>Therefore, allow <code>OPTIONS</code> calls in your <code>AuthorizationPolicy</code> to allow pre-flight requests.</p>
<pre><code>- to:
    - operation:
        methods: [&quot;OPTIONS&quot;]
</code></pre>
