Allow Cors Origin in ASP.NET Core

Question

I am using Microsoft.ApsNetCore.Cors 2.2

"Access to XMLHttpRequest at 'exampleapi.local' from origin 'example.local' has been blocked by CORS policy:
No 'Access-Control-Allow-Origin' header is present on the requested resource."

I set the settings with this:

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors(options =>
    {
        options.AddPolicy("AllowSpecificOrigin",
                builder =>
                {
                    builder                            
                    .AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader();
                });
    });

    services.Configure<TokenSettings>(this.Configuration.GetSection("Tokens"));
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(opt =>
        {
            opt.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = Configuration["Tokens:Issuer"],
                ValidAudience = Configuration["Tokens:Audience"],
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Tokens:SecurityKey"]))
            };
        });

    services.AddMvc();
    services.Configure<LdapConfig>(Configuration.GetSection("ldap"));
    services.AddScoped<ILdapAuthenticationService, LdapAuthenticationService>();
    services.AddScoped<IUserService, UserService>();
    services.AddScoped<IProjectService, ProjectService>();
    services.AddScoped<IProjectMembersService, ProjectMembersService>();
    services.AddScoped<IJourneyUsersService, JourneyUsersService>();
    services.AddScoped<IProjectRolesService, ProjectRolesService>();
    services.AddScoped<IPmoGuardianService, PmoGuardianService>();
    services.AddScoped<IHolidaysService, HolidaysService>();
    services.AddScoped<IMailService, MailService>();
    services.AddScoped<INotificationsService, NotificationsService>();
    services.AddScoped<INotificationUsersService, NotificationUsersService>();
    services.Configure<AWSConfigSes>(Configuration.GetSection("AWSSmtp"));
    services.AddDbContext<JourneyContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("JourneyConnection")));
    services.AddDbContext<TSMContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("TSMConnection")));
    services.AddDbContext<PmoGuardianContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("PmoGuardianConnection")));

}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, IMailService mail, INotificationsService not)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    Recurrence recurrency = Recurrence.GetInstance(not);
    //new TSMClockService(mail);

    app.UseCors("AllowSpecificOrigin");
    app.UseAuthentication();

    app.UseMvc();
}

[Produces("application/json")]
[Route("api/Mail")]
[EnableCors("AllowSpecificOrigin")]

But It doesn't work, always I got the same error

The CORS headers have to be set by the target server, not your server. They have to give you access, not the other way around. — user47589
– user47589, Commented Jan 11, 2019 at 15:43
Not yet, I will try to do a downgrade to Cors, I hope to resolve the problem with that. And you?? @Capo — Christian Herrejon
– Christian Herrejon, Commented Jan 14, 2019 at 15:58
@ChristianHerrejon - this may be a shot in the dark for you, but I was able to finally get things working by adding <system.webServer> <validation validateIntegratedModeConfiguration="false" />..</system.webServer> to my webconfig on my server. I updated our hosting package for core v2 as well, but this seemed to have no effect. Hopefully this will help! — Capo
– Capo, Commented Jan 14, 2019 at 22:00

milosponj · Accepted Answer · 2020-01-31 15:19:17Z

3

I've just lost a couple of minutes trying to figure out why CORS isn't working for requests from http://localhost:8080 that I've setup according to the official documentation.

Well it's because I added a '/' at the end of the URL. So, remove your '/' from the allowed origins.

There's even a Note on the Microsoft docs about this!

Note: The URL must not contain a trailing slash (/). If the URL terminates with /, the comparison returns false and no header is returned.

answered Jan 31, 2020 at 15:19

milosponj

1187 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Ben Rinehart · Accepted Answer · 2019-01-11 15:57:43Z

1

Amy's right in her comment. CORS headers need to be set by the target server, not yours.

You will often find issues with CORS if you are trying to hook into an API on a different port but running locally on the same IP address (a most common example is localhost:<> trying to ping localhost<>, etc.).

If you are trying to run this on your local machine with Google chrome you can download the below extension which will allow you to toggle on and off the CORS rule so you can test locally: Allow CORS: Access-Control-Allow-Origin

answered Jan 11, 2019 at 15:57

Ben Rinehart

342 bronze badges

1 Comment

Christian Herrejon Over a year ago

Thank you. If I am on localhost, the API works fine but if I am on production, the API gets the error

Jonathan Alfaro · Accepted Answer · 2019-01-11 16:03:55Z

1

This is the exmple provided here:ASP.NET Core 2.2

public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(options =>
        {
            options.AddPolicy("AllowSpecificOrigin",
                builder => builder.WithOrigins("http://example.com"));
        });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env, 
        ILoggerFactory loggerFactory)
    {
        loggerFactory.AddConsole();

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        // Shows UseCors with named policy.
        app.UseCors("AllowSpecificOrigin");

        app.Run(async (context) =>
        {
            await context.Response.WriteAsync("Hello World!");
        });
    }

The finally use it like this on the controller or action:

[EnableCors("AllowSpecificOrigin")]

Also for some reason make sure that app.UseCors is called before app.UseMVC.

Also if all you need is CORS from a single origin; you use simpler solution with no policies:

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors();
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    app.UseCors(
        options => options.WithOrigins("http://example.com").AllowAnyMethod()
    );

    app.UseMvc();
}

edited Jan 11, 2019 at 16:03

answered Jan 11, 2019 at 15:52

Jonathan Alfaro

4,4063 gold badges34 silver badges34 bronze badges

1 Comment

Christian Herrejon Over a year ago

I tried both but It doesn't work, anyway I am grateful

Cray · Accepted Answer · 2020-02-21 06:17:39Z

1

Simple and easy way to do it.

Install package

Install-Package Microsoft.AspNetCore.Cors

Put the code below in startup.cs file

app.UseCors(options => options.AllowAnyOrigin());

edited Feb 21, 2020 at 6:17

Cray

2,8468 gold badges25 silver badges34 bronze badges

answered Feb 21, 2020 at 5:32

pintu sharma

1792 silver badges3 bronze badges

Comments

KyleMit · Accepted Answer · 2021-05-10 16:58:51Z

1

I know this is an old question but if like me you're using the appsettings.json file for configuration, be sure to add this:

"cors": {
  "rules": [
    {
      "origin": "https://localhost:44379",
      "allow": true
    }
  ]
}

This simple addition made everything magically work for me.

edited May 10, 2021 at 16:58

KyleMit♦

31.4k74 gold badges517 silver badges712 bronze badges

answered Jul 25, 2019 at 9:03

watermelonn

111 bronze badge

Collectives™ on Stack Overflow

Allow Cors Origin in ASP.NET Core

5 Answers 5

Comments

1 Comment

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

1 Comment

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related