How to allow CORS for ASP.NET WebForms endpoint?

Question

I am trying to add some [WebMethod] annotated endpoint functions to a Webforms style web app (.aspx and .asmx).

I'd like to annotate those endpoints with [EnableCors] and thereby get all the good ajax-preflight functionality.

VS2013 accepts the annotation, but still the endpoints don't play nice with CORS. (They work fine when used same-origin but not cross-origin).

I can't even get them to function cross-origin with the down and dirty

HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Origin", "*");

approach -- my browsers reject the responses, and the cross-origin response headers don't appear.

How can I get CORS functionality in these [WebMethod] endpoints?

WebForms actively made it difficult to modify headers, e.g. as soon as something is sent to user, you can't change headers. Here is one hack that I've use before: stackoverflow.com/questions/4091157/… — MatthewMartin
– MatthewMartin, Commented Mar 3, 2016 at 16:31
And another way to do it with webconfig stackoverflow.com/questions/2922178/… — MatthewMartin
– MatthewMartin, Commented Mar 3, 2016 at 16:32
And a more modern way to manipulate headers using owin middleware: mikesdotnetting.com/article/269/… — MatthewMartin
– MatthewMartin, Commented Mar 3, 2016 at 16:36

AhHatem · Accepted Answer · 2018-04-21 14:55:34Z

26

+250

I recommend double-checking you have performed all steps on this page: CORS on ASP.NET

In addition to:

Response.AppendHeader("Access-Control-Allow-Origin", "*");

Also try:

Response.AppendHeader("Access-Control-Allow-Methods","*");

Try adding directly in web config:

<system.webServer>
   <httpProtocol>
     <customHeaders>
       <add name="Access-Control-Allow-Methods" value="*" />
       <add name="Access-Control-Allow-Headers" value="Content-Type" />
     </customHeaders>
   </httpProtocol>
</system.webServer>

Failing that, you need to ensure you have control over both domains.

edited Apr 21, 2018 at 14:55

AhHatem

1,4653 gold badges15 silver badges24 bronze badges

answered Mar 7, 2016 at 22:56

MikeDub

5,3234 gold badges33 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Sotiris Zegiannis Over a year ago

You are the greatest programmer of the known world! Poems will be written,statuses will be built in your holy name!

Paolo Over a year ago

this is not the correct answer, the user asked a way to enable CORS on webmethods not webapi

Senshaw · Accepted Answer · 2021-12-05 15:14:56Z

3

FYI, enable CORS in classic webform. In Global.asax

void Application_Start(object sender, EventArgs e)
    {        
        GlobalConfiguration.Configuration.EnableCors();        
        RouteTable.Routes.MapHttpRoute(
     name: "DefaultApi",
     routeTemplate: "api/{controller}/{action}/{id}",
     defaults: new { id = System.Web.Http.RouteParameter.Optional }
 );

answered Dec 5, 2021 at 15:14

Senshaw

311 bronze badge

Comments

AviD · Accepted Answer · 2016-03-10 00:23:41Z

If you need the preflight request, e.g. so you can send authenticated requests, you are not able to set Access-Control-Allow-Origin: *. It must be a specific Origin domain.
Also you must set the Access-Control-Allow-Methods and Access-Control-Allow-Headers response headers, if you are using anything besides the defaults.
(Note these constraints are just how CORS itself works - this is how it is defined.)

So, it's not enough to just throw on the [EnableCors] attribute, you have to set values to the parameters:

[EnableCors(origins: "https://www.olliejones.com", headers: "X-Custom-Header", methods: "PUT", SupportsCredentials = true)]

Or if you want to do things manually and explicitly:

HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Origin", "https://www.olliejones.com");
HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Headers", "X-Custom-Header");
HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Methods", "PUT");
HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Credentials", "true");

One last thing - you do have to call .EnableCors() on initiation. In e.g. MVC or WebAPI, you would call this on HttpConfiguration, when registering the config and such - however I have no idea how it works with WebForms.

Nirav Patel · Accepted Answer · 2016-03-10 11:54:02Z

If you use the AppendHeader method to send cache-specific headers and at the same time use the cache object model (Cache) to set cache policy, HTTP response headers that pertain to caching might be deleted when the cache object model is used. This behavior enables ASP.NET to maintain the most restrictive settings. For example, consider a page that includes user controls. If those controls have conflicting cache policies, the most restrictive cache policy will be used. If one user control sets the header "Cache-Control: Public" and another user control sets the more restrictive header "Cache-Control: Private" via calls to SetCacheability, then the "Cache-Control: Private" header will be sent with the response.

You can create a httpProtocol in web config for customHeaders.

<httpProtocol>
     <customHeaders>
       <add name="Access-Control-Allow-Methods" values="*" />        
     </customHeaders>
   <httpProtocol>

Joe Park · Accepted Answer · 2017-08-22 10:46:06Z

0

For the web form, you can use

Response.AddHeader("Access-Control-Allow-Origin", "*");

instead of

Response.AppendHeader("Access-Control-Allow-Origin", "*");

The first one works for old version of ASP.Net Web Form.

edited Aug 22, 2017 at 10:46

answered May 23, 2017 at 0:28

Joe Park

1051 silver badge7 bronze badges

Comments

我零0七 · Accepted Answer · 2025-02-17 03:43:22Z

In my case,I need to allow mutilple domain. So I add this code:

public class HttpModule : IHttpModule
{
    public void Init(HttpApplication application)
    {
        application.BeginRequest += Application_BeginRequest;
    }

    private void Application_BeginRequest(object sender, EventArgs e)
    {
        HttpApplication application = (HttpApplication)sender;
        HttpContext context = application.Context;

        if (context.Request.HttpMethod == "OPTIONS")
        {
            string origin = HttpContext.Current.Request.Headers["Origin"];
            string allowedOrigins = ConfigurationManager.AppSettings["allowOrigin"];

            if (!string.IsNullOrEmpty(origin) && allowedOrigins != null && allowedOrigins.Contains(origin))
            {
                context.Response.AddHeader("Access-Control-Allow-Origin", origin);
                context.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
                context.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
                context.Response.AddHeader("Access-Control-Allow-Credentials", "true");
                context.Response.End();
            }
        }

        if (context.Request.HttpMethod == "GET")//I only need get 
        {
            string origin = HttpContext.Current.Request.Headers["Origin"];
            string allowedOrigins = ConfigurationManager.AppSettings["allowOrigin"];

            if (!string.IsNullOrEmpty(origin) && allowedOrigins != null && allowedOrigins.Contains(origin))
            {
                context.Response.AddHeader("Access-Control-Allow-Origin", origin);
                context.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
                context.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
                context.Response.AddHeader("Access-Control-Allow-Credentials", "true");
            }
        }
    }

and the allowOrigin config is in Web.config

  <appSettings>
    <!--fix CORS error-->
      <add key="allowOrigin" value="https://xxxx,https://yyyy,http://localhost:4430"/>
  </appSettings>

marr75 · Accepted Answer · 2016-03-09 15:59:41Z

-1

I think your code looks good, but IIS does not send the header entity alone with response expectedly. Please check whether IIS is configured properly.

Configuring IIS6
Configuring IIS7

If CORS doesn't work for your particularity problem, maybe jsonp is another possible way.

edited Mar 9, 2016 at 15:59

marr75

5,7251 gold badge29 silver badges41 bronze badges

answered Mar 4, 2016 at 6:53

stanleyxu2005

8,31115 gold badges61 silver badges99 bronze badges

2 Comments

user5447154 Over a year ago

Maybe json is another possible way. how?

stanleyxu2005 Over a year ago

I guess you mis-read JSONP as JSON. A JSONP response is a standard JSON string wrapped in a function call. Every modern browser is able to evaluate JSONP response without origin domain policy restriction. You can find some solution for c# like this stackoverflow.com/questions/14221429/…

Ankur Shah · Accepted Answer · 2016-03-10 12:57:08Z

-2

You can do like this in MVC

[EnableCors(origins: "*", headers: "*", methods: "*")]
public ActionResult test()
{
     Response.AppendHeader("Access-Control-Allow-Origin", "*");
     return View();
}

answered Mar 10, 2016 at 12:57

Ankur Shah

4306 silver badges16 bronze badges

1 Comment

AaA Over a year ago

OP is not doing this in MVC as he specified in his post title.

Collectives™ on Stack Overflow

How to allow CORS for ASP.NET WebForms endpoint?

8 Answers 8

2 Comments

Comments

Comments

Comments

Comments

Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

8 Answers 8

2 Comments

Comments

Comments

Comments

Comments

Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related