How to enable cross origin requests in ASP.NET MVC

Question

I am trying to create a web application which works with cross-origin requests (CORS) in MVC 5. I have tried everything without any result.

With an attribute

public class AllowCrossSiteJsonAttribute: ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
            filterContext.RequestContext.HttpContext.Response.AddHeader("Access-Control-Allow-Origin", "*");

        base.OnActionExecuting(filterContext);
    }
}

With EnableCors attribute

 [EnableCors("*")]

Nothing works I'm starting to think that it is impossible

Have you read the samples: https://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api — Sami Kuhmonen, Oct 17 '16 at 05:47
I found the solution in this post : https://forums.asp.net/post/5795304.aspx — mejiamanuel57, Jun 14 '18 at 20:06

Yogi · Answer 1 · 2016-10-17T06:41:29.067

64

Add the configuration setting in your web.config file to set the value for Access-Control-Allow-Origin in customHeaders like this -

<configuration>
 <system.webServer>
   <httpProtocol>
     <customHeaders>
       <add name="Access-Control-Allow-Origin" value="*" />
     </customHeaders>
   </httpProtocol>
 </system.webServer>
</configuration>

You would like to visit this and this for more details and some other options.

edited Oct 17 '16 at 06:41

answered Oct 17 '16 at 06:33

Yogi

9,174
2
46
61

8

it is showing the result like this: "from origin 'http://127.0.0.1:8787' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status." – Istiyak Jan 09 '19 at 10:00
In my case, I needed to set "Access-Control-Allow-Origin" with "*" as indicated in this answer, but.... I also needed to add this to my angularjs clientside `$http` call: `headers: {'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8'}` – sports Mar 17 '23 at 17:27

score 59 · Answer 2 · edited May 23 '17 at 11:55

What I think is the most convenient is to create your own class like this :

with the following code in it :

using System;
using System.Web.Mvc;

public class AllowCrossSiteAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        filterContext.RequestContext.HttpContext.Response.AddHeader("Access-Control-Allow-Origin", "http://localhost:4200");
        filterContext.RequestContext.HttpContext.Response.AddHeader("Access-Control-Allow-Headers", "*");
        filterContext.RequestContext.HttpContext.Response.AddHeader("Access-Control-Allow-Credentials", "true");

        base.OnActionExecuting(filterContext);
    }
}

After this it's let you use this decorator on a method or on the whole controller

You should be able to see that in your response header after this procedure

Thank's to this response

You should also include `filterContext.RequestContext.HttpContext.Response.AddHeader("Vary", "Origin");` — Ibraheem, Apr 10 '18 at 14:09
but i got error as "EventSource's response has a MIME type ("application/json") that is not "text/event-stream". Aborting the connection" — Ishara Samintha, Nov 11 '19 at 09:44

score 1 · Answer 3 · answered Jun 01 '17 at 19:22

1

I've had success using the OWIN CORS implementation (nuget Microsoft.Owin.Cors) to enable Cors for MVC Controllers and Owin middleware, in addition to ApiControllers. Microsoft.AspNet.WebApi.Cors (using config.EnableCors() and the [EnableCors] attribute) only seems to work with ApiControllers.

See http://benfoster.io/blog/aspnet-webapi-cors for sample code.

answered Jun 01 '17 at 19:22

PointZeroTwo

2,142
1
17
15

1

Best answer if you don't want to use the wildcard '*'. – Flo Mar 05 '20 at 10:36

Alex Nguyen · Answer 4 · 2016-10-17T06:46:48.790

I think you have to add it into "OnAuthentication" step or add config into your web config. You can try my code :) it works

 public class AllowCrossSiteJsonAttribute : ActionFilterAttribute, IAuthorizationFilter
    {
        public void OnAuthorization(AuthorizationContext filterContext)
        {
            filterContext.RequestContext.HttpContext.Response.AddHeader("Access-Control-Allow-Origin", "*");
        }

    }

score 0 · Answer 5 · answered Jun 28 '17 at 12:37

0

You can also use below code to allow cross-origin request

public void ProcessRequest (HttpContext context)
        {
     context.Response.AddHeader("Access-Control-Allow-Origin" , "*");
}

answered Jun 28 '17 at 12:37

Rakesh Chaudhari

3,310
1
27
25

Where does this code go? – Captain Kenpachi Feb 11 '19 at 09:28
inside global.asax file – Rakesh Chaudhari Feb 11 '19 at 13:42

Mostafiz · Answer 6 · 2016-10-17T06:16:24.447

-2

Enabling CORS in mvc 5(core) first need to add Microsoft.AspNetCore.Cors package to your project. Then configure startup.cs like this for all website

public void ConfigureServices(IServiceCollection services)
 {
     services.AddMvc();
     //Add Cors support to the service
     services.AddCors();

     var policy = new Microsoft.AspNet.Cors.Core.CorsPolicy();

     policy.Headers.Add("*");    
     policy.Methods.Add("*");          
     policy.Origins.Add("*");
     policy.SupportsCredentials = true;

     services.ConfigureCors(x=>x.AddPolicy("AllPolicy", policy));

 }


 public void Configure(IApplicationBuilder app, IHostingEnvironment  env)
 {
     // Configure the HTTP request pipeline.

     app.UseStaticFiles();
     //Use the new policy globally
     app.UseCors("AllPolicy");
     // Add MVC to the request pipeline.
     app.UseMvc();
 }

and then also you can use like this

[EnableCors("AllPolicy")]

Details here

edited Oct 17 '16 at 06:16

answered Oct 17 '16 at 05:45

Mostafiz

7,243
3
28
42

An error: EnableCors doesn't take origins parameter – Petar Bechev Oct 17 '16 at 05:47
which version of asp.net mvc you are using ? – Mostafiz Oct 17 '16 at 05:49
ohh for 5 things are different, check out the link in my update – Mostafiz Oct 17 '16 at 05:52
check update, I have added for mvc 5 – Mostafiz Oct 17 '16 at 05:56
This solution is for .net core mvc, not suitable for mvc 5 (.net framework) – Anh Hoang Sep 16 '20 at 08:33

score -6 · Accepted Answer · edited Sep 07 '19 at 21:02

-6

To enable cross-origin requests, add the [EnableCors] attribute to your Web API controller or controller method:

[EnableCors(origins: "http://systematixindia.com", headers: "*", methods: "*")]
public class TestController : ApiController
{
   // Controller method`enter code here`s not shown...
}

How to enable cross origin requests in ASP.NET MVC

7 Answers7

Linked