带有身份的 ASP.NET 中的 CORS 策略

Question

I published API to IIS server and everything works fine despite of one function:

Error only shows up when we test a function on localhost, but if i use postman everything work. That is the only place in my code where i use Cors: What can i do to allow sendind request on localhost?

Answer 1

It works through postman because CORS is a browser implementation thing. Which is also why some calls might work through older IE versions. Postman does not check the CORS header and thus does not care.
CORS is to prevent XSS (I believe).

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS is great reading on the subject.

Cross-Origin Resource Sharing (CORS) is an HTTP-header based mechanism that allows a server to indicate any other origins (domain, scheme, or port) than its own from which a browser should permit loading of resources.

So basically it is telling you that the token service does not allow you to call it cross-origin.
CORS is a response header that the browser checks.

1. Browser sends request to token service
2. Token service responds.
3. Browser checks if CORS is allowed.
4. No.
5. Fail the "request".

TLDR; CORS is a response header, that the browser checks for whether or not to allow the response to go through to you. The header must be set by the service you are calling.