Issue in CORS in ASP .NET Core - The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*

Question

I'm getting the below error

Access to XMLHttpRequest at 'http://localhost:5000/api/values/track/?name=name&time=1589425390870' from origin 'http://localhost:23456' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

I have configured Asp.net core app like below

public void ConfigureServices(IServiceCollection services)
        {

            services.AddCors(o => o.AddPolicy("MyPolicy", builder =>
            {
                builder.AllowAnyOrigin()
                       .AllowAnyMethod()
                       .AllowAnyHeader().AllowCredentials() ;
            }));


            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
        }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseCors("MyPolicy");
            app.UseMvc();
        }

Content type: application/x-www-form-urlencoded

Can some one please help me in resolving this issue?

Fei Han · Accepted Answer · 2020-05-14 03:21:36Z

6

The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

As error indicates that you configure your app with both AllowAnyOrigin and AllowCredentials methods, which cause that the CORS service returns an invalid CORS response.

You can modify the code to enable specific origins, like below.

builder.WithOrigins("set_specified_origins_here")
        .AllowAnyMethod()
        .AllowAnyHeader()
        .AllowCredentials();

For detailed information about "Set the allowed origins", please check following doc: https://learn.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.0#set-the-allowed-origins-1

answered May 14, 2020 at 3:21

Fei Han

28k1 gold badge35 silver badges47 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Shajin Chandran Over a year ago

Fei Han, It worked for me. Really thank you from bottom of my heart :) Thanks for quick help.

Collectives™ on Stack Overflow

Issue in CORS in ASP .NET Core - The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related