如果从 [授权] 重定向到帐户/登录，CORS 会出现 oauth 问题

Question

public class AccountController : Controller
{
    public IActionResult Login(string returnUrl)
    {
        return new ChallengeResult(
            GoogleDefaults.AuthenticationScheme,
            new AuthenticationProperties
            {
                RedirectUri = Url.Action(nameof(LoginCallback), new { returnUrl })
            });
    }
...

I have the controller shown above. If I type https://localhost:44378/Account/Login in the browser address bar it works fine - I get redirected to the Google authorization page but if I get redirected to this endpoint by hitting [Authorize] or a similar attribute on another endpoint I'm getting error like the following one:

Access to XMLHttpRequest at 'https://accounts.google.com/o/oauth2/v2/auth?...' ( redirected from 'https://localhost:44378/api/some-action') from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

JIC, I added http://localhost:3000 to both Authorized JavaScript origins and Authorized redirect URIs in the app registration Google page.

Why so and how to solve it?

EDIT: Network:

EDIT2:

I created test project with frontend and backend on the same port, the issue persists

(redirected from 'https://localhost:44336/weatherforecast') from origin 'https://localhost:44336' has been blocked by CORS policy

Answer 1

The local HTTP server (the one that is serving https://localhost:[Port]/... needs to be configured to respond to HTTP OPTIONS request with Access-Control-Allow-Origin: '*' in the response headers.

In case of cross domain requests, Browsers(especially chrome) make a HTTP OPTIONS request for the same endpoint before HTTP GET or HTTP POST

Answer 2

Try with this in your Startup.cs file.

this inside the class -> readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";

and this inside the ConfigureServices method

services.AddCors(options =>
        {
           options.AddPolicy(name: MyAllowSpecificOrigins,
                              builder =>
                              {
                                  builder.WithOrigins("http://localhost:4200");
                              });
         });

change the address and port with yours

you can check this link as well: https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0