尽管为 web API 配置，但未启用 CORS

Question

Trying to access a local API made in web API 2.0 (asp.net) from an angular project.

The request results in

Access to XMLHttpRequest at 'http://localhost:50581/MD/GetUserMD' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

But I don't understand as I added EnableCors to the webAPIConfig

and specified these in all the controllers.

Is there something I could try to resolve this issue? Thank you in advance.

Answer 1

CORS allows you to specify who is able to call your API. So more is needed than just enabling CORS; you need to set the policies. There are a couple ways to do that:

1. With the [EnableCors] attribute, which can be set at either the Controller or Action level:

[EnableCors(origins: "http://localhost:4200", headers: "*", methods: "*")]

2. For your entire application:

public static void Register(HttpConfiguration config)
{
    var cors = new EnableCorsAttribute("[EnableCors(origins: "http://localhost:4200", "*", "*");
    config.EnableCors(cors);
}

You can set the origin to "*" to allow any website to make requests to your API, but be careful with that.

More information here: Enable cross-origin requests in ASP.NET Web API 2