添加AllowAnyHeader不允许.NET Core 3.1中的所有标头

Question

In my .NET Core 3.1 Startup program, I have something like this:

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors(options =>
    {
        options.AddDefaultPolicy(
            builder =>
            {
                builder.AllowAnyHeader();
                builder.AllowAnyMethod();
                builder.AllowAnyOrigin();
            });
    });
}

I was expecting that AllowAnyHeader would add "Access-Control-Allow-Methods": "GET,POST,PUT,DELETE,OPTIONS"; to the response header, but when I call a DELETE in a method configured with [HttpDelete] in the Controller, I see the following in the response header:

access-control-allow-methods → GET (no DELETE or OPTIONS)

So, what should I do to see all methods allowed in the response header?

Answer 1

You can use this instead in Configure

app.UseCors(x => x
            .AllowAnyMethod()
            .AllowAnyHeader()
            .AllowCredentials());

or you should use

services.AddCors(options =>
{
options.AddDefaultPolicy(
    builder =>
    {
        builder.AllowAnyOrigin()
               .AllowAnyHeader()
               .AllowAnyMethod();
    });
});

then use it in Configure

app.UseCors();