GCP's Extensible Service Proxy cannot do Cross-Origin Resource Sharing. We put a HAProxy in front of it to handle CORS.

haproxy-esp-cors.cfg

# Add CORS headers when Origin header is present
capture request header origin len 128
http-response set-header Access-Control-Allow-Origin %[capture.req.hdr(0)] if { capture.req.hdr(0) -m found }
http-response set-header Access-Control-Allow-Methods GET,\ HEAD,\ OPTIONS,\ POST,\ PUT  if { capture.req.hdr(0) -m found }
http-response set-header Access-Control-Allow-Credentials true  if { capture.req.hdr(0) -m found }
http-response set-header Access-Control-Allow-Headers Origin,\ Accept,\ X-Requested-With,\ Content-Type,\ Access-Control-Request-Method,\ Access-Control-Request-Headers,\ Authorization  if { capture.req.hdr(0) -m found }

# Google Cloud Platform ESP does not support CORS
# We want to return a 204 regardless
http-response set-status 204 if { capture.req.hdr(0) -m found } METH_OPTIONS
http-response set-header Content-Type text/plain;\ charset=utf-8 if { capture.req.hdr(0) -m found } METH_OPTIONS
http-response set-header Content-Length 0 if { capture.req.hdr(0) -m found } METH_OPTIONS