URL has been blocked by CORS policy

Question

I'm getting below error on calling API from ASP.Net MVC in angular version 1

Error: Access to XMLHttpRequest at 'URL 1' from origin 'URL 2' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

I use below code in WebApiConfig:

     var corsAttr = new EnableCorsAttribute("*","*","*");
                config.EnableCors(corsAttr);

After that I tried to use below code :

var corsAttr = new EnableCorsAttribute("*","Content-Type", "GET,POST,PUT,DELETE,OPTIONS");
            config.EnableCors(corsAttr);

and:

var corsAttr = new EnableCorsAttribute("https://rushpeik.ir","Content-Type", "GET,POST,PUT,DELETE,OPTIONS");
            config.EnableCors(corsAttr);

But the problem remains

Does this answer your question? [How to enable CORS in ASP.NET Core](https://stackoverflow.com/questions/31942037/how-to-enable-cors-in-asp-net-core) — nilsK, Jan 20 '21 at 12:41
A common mistake people seem to make in this situation is to be trying to apply CORS settings in the wrong project - so, to be clear, the code you're showing is code you've added to the *API* project? — Damien_The_Unbeliever, Jan 20 '21 at 15:57

score 3 · Accepted Answer · answered Jan 25 '21 at 12:39

I found the solution:

At the first have to use below code in WebApiConfig

     var corsAttr = new EnableCorsAttribute("*","*","*");
                config.EnableCors(corsAttr);

After that add below code to web.config

<httpProtocol>
  <customHeaders>
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Headers" value="Content-Type" />
    <add name="Access-Control-Allow-Methods" value="GET,POST,PUT,DELETE,OPTIONS" />
    <add name="Access-Control-Allow-Credentials" value="true" />
  </customHeaders>
</httpProtocol>

We have to allow all custom headers in "Access-Control-Allow-Headers" like below line:

 <add name="Access-Control-Allow-Headers" value="Content-Type,Token,Username" />

It worked for me :)

score 2 · Answer 2 · answered Jan 20 '21 at 11:48

2

Here you need to add this in your Configure() method in your startup.cs

app.UseCors(builder => builder.WithOrigins("*")
                               .AllowAnyMethod()
                               .AllowAnyHeader());

answered Jan 20 '21 at 11:48

Bhavin Varsur

317
1
15

score 2 · Answer 3 · answered Jan 20 '21 at 15:14

2

Add this above your Api Class

[EnableCors(origins: "https://rushpeik.ir", headers: "*", methods: "*")] 
public class YourController : ApiController
{
        // Whatever
}

answered Jan 20 '21 at 15:14

Mertez

1,061
3
14
38

URL has been blocked by CORS policy

3 Answers3