CORS 在 ASP.NET 核心 Web API 项目中不工作

Question

I built an ASP.NET core Web API (net core 3.1), and I try to enable CORS but it seems not working.

Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors(options =>
    {
        options.AddPolicy("AllowMyOrigin",
        builder =>
        {
            builder.SetIsOriginAllowed(t => true)
            .AllowCredentials();
        });
    });
    ...
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    //app.UseHttpsRedirection();


    app.UseRouting();

    app.UseCors("AllowMyOrigin");

    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllers();
    });
    app.UseHttpsRedirection();
}

Controller:

[Route("api/[controller]")] 
[ApiController]
public class airdata_updateController : ControllerBase
{
    [EnableCors("AllowMyOrigin")]
    [HttpGet]
    public string test()
    {
        return "ok";
    }

    ...
}

I use Postman test my API on local computer and it working well: local computer

But I use Postman on other computer in the same LAN to call my API, it failed: other computer

What should I do?

Answer 1

Try this:

    public void ConfigureServices(IServiceCollection services)
    {
        ...
        
         services.AddCors();

        ...
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
       ...
       
        app.UseCors(
            options => options.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod()
        );

       ...
    }

You won't need any decorators in your controller methods, the specified CORS policy ( AllowAnyOrigin, AllowAnyHeader, AllowAnyMethod) is applied in all of them. In order to customize the policy, check https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-3.1

Answer 2

maybe this option can help you.

services.AddCors(options =>
            {
                options.AddPolicy("AllowMyOrigin",
                    builder => builder
                        .AllowAnyMethod()
                        .AllowAnyHeader()
                        .AllowAnyOrigin()

                );
            });