ASP.NET 5/Core/vNext CORS not working even if allowing pretty much everything

Question

I have a ASP.NET 5 Web API (Well, MVC now anyway) back-end which I am consuming in with the axios library in my JS app.

My CORS config in MVC is the following:

public void ConfigureServices(IServiceCollection services)
{
      services.AddMvc();
      services.AddCors();
} 


public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{ 
      app.UseCors(builder => {
          builder.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader();
      });
}

So in other words, I should be allowing every request possible. However, while this fixed preflight requests, a POST requests still gets rejected (I can see it executes on the server, but there's no header in the response so it results in a client side error).

Does anyone have any ideas why this wouldn't work ?

These are the headers that are returned by the MVC api:

• For the OPTIONS preflight (this one passes):
• For the actual POST request (this one does NOT pass):

Answer 1

You have to add Cors before MVC. The registration order of the middleware is important. If Cors is registered after mvc it will never be called. They are called in the order of registration.

Once cors process the request, it will pass it to next middleware (Mvc)

Answer 2

@Norgerman mentioned this in the comments, but I think it is worthy of an answer because I've made this mistake myself several times:

The CORS middleware only works on actual cross-domain requests

It is not fired if you just access a same domain request like typing a URL into the browser.

This means if you are testing you have to either use an actual cross-domain request from an XHR client on another port or domain, or an HTTP client that can explicitly poke an origin header into the HTTP request.

Answer 3

The problem was actually in the fact that there was an exception in the action processing the POST request and as Norgerman mentioned, the default exception handler cleared the CORS headers.

Answer 4

For .net core 1.1:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{ 
    app.UseCors(x => x.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader().AllowCredentials());
}

Answer 5

Assuming that you are trying to create a truly PUBLIC endpoint, this worked for me:

Make sure that this:

app.UseCors(builder => {
    builder.AllowAnyOrigin()
    builder.AllowAnyMethod()
    builder.AllowAnyHeader()
});

Occurs before any of these:

app.UseHttpsRedirection();
app.UseDefaultFiles();
app.UseStaticFiles();
app.UseCookiePolicy();

app.useMvc();

Remember, we are dealing with a "pipeline". The cors stuff has to be first.

Also - (again, I'm assuming, "public endpoint") - make sure that your XHR call has... xhr.withCredentials = false;

... or just omit it. If you have it set to "true", you will get a CORS warning about the "Wildcard".

Answer 6

If you're using UseHttpsRedirection, make sure your app is calling the https URL and not the http one or you'll get a CORS error even though the Accept-Header-Allow-Origin header is returned.

Answer 7

This is what worked for me as I was having the same problem with CORS in conjunction with axios.

Assuming that you have set up the API correctly and you have decorated the class in the API Controller with:

[EnableCors("YourCorsPolicy")]

(you will need to add the statement "using Microsoft.AspNetCore.Cors;" to your class too)

Then you need to use the following in your axios-auth.js file:

axios.defaults.headers.common['Access-Control-Allow-Origin'] = '*'

This then worked fine for me over https. This is my complete axios-auth if you need a guide.

import axios from 'axios'

const instance = axios.create({
  baseURL: 'https://localhost:56799/api'
})

axios.defaults.headers.common['Access-Control-Allow-Origin'] = '*'
axios.defaults.headers.get['Accepts'] = 'application/json'
axios.defaults.headers.post['Content-Type'] = 'application/json; charset=utf-8'

export default instance

I hope this is useful.

Answer 8

For me helps this:

services.AddCors(options =>{
  options.AddPolicy(AllowAllCorsPolicy, builder =>{
    builder
    .SetIsOriginAllowed(x =>_ = true)
    .AllowAnyMethod()
    .AllowAnyHeader()
    .AllowCredentials();
  });
});

Taken from .

Answer 9

Please notice that Windows Firewall and project's .vs\config\applicationhost.config must be properly set up besides enabling CORS in your project. The checklist below can help:

1. Is the port used by your application/API open in the firewall? If not, open it.

2. Open your project .vs\config\applicationhost.config file and search for <binding protocol="http" bindingInformation="*:NNNNN:localhost" /> (where NNNNN is the number of the IP port used by your application/API). Add a second line after that, <binding protocol="http" bindingInformation="*:NNNNN:*" />, so you allow any IP address to access your application.

Restart IIS Express and remember that running Visual Studio as Administrator is important most of times.

After that, continue your CORS set up and testing.