enabling CORS in .net core webAPI

Question

I've installed NuGet package Microsoft.AspNetCore.Cors 2.2.0 then in my .net core webAPI Startup.cs I have done the following:

public void ConfigureServices(IServiceCollection services) { 
......
services.AddCors();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    app.UseCors(options =>
    options.WithOrigins("http://localhost:52556")
    .AllowAnyMethod()
    .AllowAnyHeader());

    app.UseMvc();
}

Then when I send post request from my angular app in console I see this error:

Access to XMLHttpRequest at ' http://localhost:52556/api/PaymentDetail ' from origin ' http://localhost:4200 ' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I thought I've enabled CORS but it seems that something is blocking it. What can be done to solve this problem ?

Answer 1

Try this way. Ithink it's because you are allowing URLs with " http://localhost:52556 " only. Using "*" will enable all URLs and if you can want you can limit it to any specific one.

public void ConfigureServices(IServiceCollection services)
{
  .........................
    services.AddCors(options =>
            {
                options.AddPolicy("NoRestrictions",
                    builder => builder.WithOrigins("*").AllowAnyHeader().AllowAnyMethod());
            });;
     ...............
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, IOptions<AppServerSettings> appServerSettings)
{
    ..........
    app.UseCors("NoRestrictions");
    ..........
}

Answer 2

You are setting Origin for you asp host.

Just replace this line

options.WithOrigins("http://localhost:52556")

with

options.WithOrigins("http://localhost:4200")

Answer 3

I solved same problem in C# by annotations/attributes,

[System.Web.Http.Cors.EnableCors(origins: "http://localhost:4200", headers: "*", methods: "*")]
public class StudentsController : ApiController{}

in MVC, use,

// For Action, 
[HttpGet]
[EnableCors("AllowSpecificOrigin")]
public IEnumerable<string> Get(){}
// For Controller,   
[Route("api/[controller]")]
[EnableCors("AllowSpecificOrigin")]
public class ValuesController : ControllerBase{}

in your case, replace with this If specific to port number process 4200 ,

options.WithOrigins("http://localhost:4200");

or you can put No Restrictions ,

app.UseCors("NoRestrictions");// To config
// To service
services.AddCors(options =>
{
  options.AddPolicy("NoRestrictions",
         builder => builder.WithOrigins("*").AllowAnyHeader().AllowAnyMethod());
});

Checks whats the origin, 1) checks port number (eg 8080 or 8888) 2) domain and sub domain (eg google.com or google.net) 3) schema (eg http or https)

register origin,

go inside Startup.ConfigureServices and call services.AddCors();

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors();
}

enable cors now, go Startup.Configure and call app.UseCors(builder => builder.WithOrigins("http://google.com"));