为ASP.NET Core MVC中的所有响应添加标头

Question

I would like to know how I can add Access-Control-Allow-Origin:* to my headers.

I've tried this unsuccessfully:

app.Use((context, next) =>
{
    context.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
    return next.Invoke();
});

Answer 1

Using app.use(...) and mutating context.Response.Headers from within Startup.Configure is correct, but it's important to do it at the right point in the chain. ASP.NET Core middleware components can "short-circuit" (see the ASP.NET Core Middleware docs), preventing further middleware from being called, and by experimenting with it I've inferred that UseMvc() does so. In an MVC application, then, this means you have to put your app.use(...) call before app.UseMvc() .

In other words, starting from the template ASP.NET Core 2.0 application that Visual Studio generates for you, you want to modify Startup.Configure in Startup.cs to look something like this:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    // Add header:
    app.Use((context, next) =>
    {
        context.Response.Headers["Access-Control-Allow-Origin"] = "*";
        return next.Invoke();
    });

    app.UseMvc();
}

Answer 2

You can also try to use the in built CORS Middleware in the asp.net core framework rather than creating your own Middleware.

In Configure method of the Startup class add the following code.

// Add CORS for YourAnotherSite
    app.UseCors(builder =>
       builder.WithOrigins("http://YourAnotherSite.com"));

OR

Use Named Policies

In Configure method of the Startup class

options.AddPolicy("AllowMyOrigin",
        builder => builder.WithOrigins("http://YourAnotherSite.com"));

and then in the ConfigureServices method of the startup class.

app.UseCors("AllowMyOrigin");

Alternatively, the Policy can be applied at each Controller or Action methods.

Answer 3

We've found the ApplicationBuilder methods inconsistent too - it's not clear when the handler is handing back to the chain (for instance UseStaticFiles() ) and when it's not ( UseMvc() ).

You don't say what environment you're running under, but if you're intending on using IIS then don't give up on web.config yet! The url rewrite module works perfectly well, and allows you to set outbound rules on all request.

There's a good answer here: https://stackoverflow.com/a/26545975/548664

Answer 4

I tried your code, and it worked beautifully... Placement is key: I'm pretty sure it needs to be early in the chain.

        public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        loggerFactory.AddConsole(Configuration.GetSection("Logging"));
        loggerFactory.AddDebug();
        //app.UseCors(builder => builder.AllowAnyHeader().AllowAnyMethod().AllowAnyOrigin());
        app.Use((context, next) => {
            context.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
            return next.Invoke();
        });
        app.UseMvc();
        app.UseWebSockets();
        app.UseSignalR();
    }