Enable CORS on a .NET Core Api?

Question

I am trying to allow my ANgular app running at localhost:4200 to be able to request data from my back end api .NET Core 2.2 api running at localhost:44337. I have added a Cores policy in ConfigureServices, added it to Configure, and added a UseCors annotation on my endpoints, but I still get this error:

Access to XMLHttpRequest at 'https://localhost:44337/api/users/1' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Startup.cs

public string DefaultCorsPolicy = "DefaultCorsPolicy";

public void ConfigureServices(IServiceCollection services) 
{
    services.AddCors(options =>
        {
            options.AddPolicy(DefaultCorsPolicy,
                builder =>
                {
                    builder
                        .AllowAnyHeader()
                        .AllowAnyMethod()
                        .WithOrigins("http://localhost:4200/");
                });
        });

        services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseCors(DefaultCorsPolicy);
    app.UseMvc();
}

UsersController.cs

[HttpGet("{id}")]
[EnableCors("DefaultCorsPolicy")]
public async Task<ActionResult> GetUser(int id)
{
    var settings = await _service.GetUser(id);
    return Ok(settings);
}

If I add Response.Headers.Add("Access-Control-Allow-Origin", "*") in the actual GetUser method, it will work. But I don't want to brute force it.

I made sure to place both AddCors and UseCors calls at the beginning of ConfigureServices and Configure respectively. But it still will not work.

Your configuration appears correct. In what way is it "not working"? Here is the MS documentation: learn.microsoft.com/en-us/aspnet/core/security/… — Robert Perry
– Robert Perry, Commented Jun 26, 2019 at 18:01
When the angular app calls the users endpoint, I would expect to receive use data - instead, I get the error above in the console. — kroe761
– kroe761, Commented Jun 26, 2019 at 18:23

Daniel · Accepted Answer · 2019-06-26 19:28:53Z

2

this is what works in my case (same what you have described). If this works you can start narrowing.

services.AddCors(options =>
{
    options.AddPolicy(DefaultCorsPolicy,
        builder => builder
            .SetIsOriginAllowed((host) => true)
            .AllowAnyMethod()
            .AllowAnyHeader()
            .AllowCredentials());
});

of course i have no [EnableCors("DefaultCorsPolicy")] Attribute as i am allowing it on all methods .AllowAnyMethod().

edited Jun 26, 2019 at 19:28

answered Jun 26, 2019 at 19:09

Daniel

9,86713 gold badges54 silver badges72 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

kroe761 Over a year ago

Yes, that worked! It looks like MS changed the syntax for AddCors for 2.2. Go figure. Thanks!

Collectives™ on Stack Overflow

Enable CORS on a .NET Core Api?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related