Generally available: API Management Content Security Policy and CORS configuration support

API Management Content Security Policy detects and mitigates common attacks in the developer portal and enables Captcha and OAuth in self-hosted portals.

Read more at Microsoft