CORS policy blocking for localhost on AspNetCore

Question

I'm trying to work with AspNetCore and I'm stuck at this. When I send a request using postman everything works fine, but when I try to do it using a browser it doesn't work. I'm using AspNetCore 3.1.

Startup.cs

namespace PMES.HelpDesk.WebAPI
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        public void ConfigureServices(IServiceCollection services)
        {
            //...

            services.AddCors(opt => 
            {
                opt.AddPolicy("AllowOrigin", options => {
                    options.AllowAnyOrigin();
                    options.AllowAnyMethod();
                    options.AllowAnyHeader();
                });
             });

           //...
        }


        public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                IdentityModelEventSource.ShowPII = true;

            }
            else
            {
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseRouting();
            app.UseCors("AllowOrigin");
            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

Error Message

Access to XMLHttpRequest at 'http://localhost:5000/api/session/authenticate' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

EDIT 1

My front end is built with Vue and that's my request

axios
.get(`http://localhost:5000/api/session/authenticate`, {
    headers: {
        Authorization:
            'Bearer ' +
             'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMTQ0NjE3Nzc0MiIsIm5hbWUiOiJGZWxpcGUgRW5kbGljaCIsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxNTk2MzM5MDIyfQ._VcxTFt6N0oe-QKeyant8lCzcpC2AL69tFcADLBbXO0'
    }
})
.then(response => {
    window.console.log(response.data);
})
.catch(error => {
    window.console.log(error);
});

EDIT 2

When I send a postman request I get these headers

Date: Thu, 06 Feb 2020 20:08:11 GMT
Server: Kestrel
Content-Length: 0
Allow: GET
Access-Control-Allow-Origin: *

Do the answers to this question address yours? https://stackoverflow.com/questions/40863417/cors-issue-with-vue-js — ColinM, Feb 06 '20 at 19:45
@Dai The project was scaffolded and I just didn't comment the line. — Felipe Endlich, Feb 06 '20 at 19:48
Can you make an OPTIONS HTTP request to the endpoint with postman to see if your cors headers are set properly? — Newbie, Feb 06 '20 at 19:48
The headers you posted doesn't look as headers of an `OPTIONS` request, you may have made a `GET` request with postman. A browser when performs the prefly makes an OPTION request which is the one that holds the CORS headers. There should be at least an `Allow` header — Newbie, Feb 06 '20 at 20:03

score 1 · Accepted Answer · answered Feb 06 '20 at 20:26

Your OPTIONS request is OK, but please note this gotcha: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials

CORS can not be break while withCredentials is set to true on the underlying AJAX controller. It looks like axios does not support it. See: https://github.com/axios/axios/pull/2582

Anyway I would neither try to hack it. You have two solutions:

Apply a specific domain to your CORS localhost:8080
Enable VUE proxy on your Vue CLI https://vuejs-templates.github.io/webpack/proxy.html

I would definetly suggest the second one, which avoids you hacking the back-end with CORS

Thank's a lot. It worked, and more important than that, now I know why. — Felipe Endlich, Feb 07 '20 at 14:11

CORS policy blocking for localhost on AspNetCore

EDIT 1

EDIT 2

1 Answers1