未启用 ASP.NET Core 2 CORS

Question

I'm developing a web application based on an Angular 6 client and ASP.NET Core WebAPI for web services.

At the moment (initial development phase) i have a simple architecture that consists of two web services, one that manages authentication and identities, the other one that holds the applicative logic (business logic, updating db, ecc.).

I'm using JWT Bearer token for client authentication.

Everything works fine with my authentication service, but when I try to call the application service I obtain this error in the Chrome browser console:

Failed to load http://localhost:59207/api/Files/Upload : No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin ' http://localhost:4200 ' is therefore not allowed access. The response had HTTP status code 500.

This error is preceded by another one:

POST http://localhost:59207/api/Files/Upload 500 (Internal Server Error)

Is, in some way, the second error I get related to the Internal Server Error it is preceded by?

I test my POST call from Postman and everything works fine, no server-side errors and the data i want back from my service is returned.

I already put in place everything I know about CORS in ASP.NET Core.

Startup class method named "ConfigureServices" contains, as first row:

        services.AddCors(options =>
        {
            options.AddPolicy("AllowAll",
                builder =>
                {
                    builder
                    .AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader()
                    .AllowCredentials();
                });
        });

Then this is called in the "Configure" method:

app.UseCors("AllowAll");

Also I put the EnableCors Attribute on every controller class like this:

[EnableCors("AllowAll")]

Anyone has an idea of how I can get out of this mess? From what I get, this is how CORS is intended to be used and I already got it running this way on other projects (but never with ASP.NET Core 2).

Thank you in advance

Answer 1

This may not be an answer to your situation, but I've run into this issue quite often in the past. It's a Chrome issue when talking between two localhost s upon POST requests.

Try using another browser and see if it works; if so, you can continue using Chrome by disabling Security

chrome.exe --user-data-dir="C://Chrome dev session" --disable-web-security

hope this helps.