CORS Issue: C# API requests work for one domain, but not to the other

Question

I'm with a CORS issue problem. I have an internet IIS server with two domains sharing the same code (Multi-tenant application) and one domain for the API.

The API is configured to accept CORS:

Startup ConfigureServices():

    services.AddCors(options =>
    options.AddDefaultPolicy(builder => builder.AllowAnyMethod().AllowAnyHeader().AllowAnyOrigin().SetIsOriginAllowed(origin => true).AllowCredentials()));
services.AddMvc();

Startup Configure():

    app.UseCors(options =>
    options.AllowAnyMethod()
        .AllowAnyHeader()
        .SetIsOriginAllowed(origin => true)
        .AllowCredentials()
);

Javascript request:

axios.post(apiurl + '/api/Usuario/primeiroacesso', '"' + this.email + '"',
{
    headers:
    {
        'Access-Control-Allow-Origin': '*',
        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS, PUT, PATCH, DELETE',
        'Access-Control-Allow-Headers': 'Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers',
        'Content-Type': 'application/json',
        hash: _hc
    }
})
.then(res => {
    console.log(res);
    if (res.status == 200) {
        alert('Verifique sua conta de email');
    } else {
        alert("O email informado não foi encontrado");
    }
})

This code works fine to Domain1 request, but when I do the same request on Domain2, I get a CORS ERROR.

How can I solve this?

score 1 · Answer 1 · answered Apr 26 '21 at 15:12

Try this syntax for APIs

public void ConfigureServices(IServiceCollection services)
        {
            services.AddCors(o => o.AddPolicy("AllowAnyOrigins", builder =>
            {
                builder.AllowAnyOrigin()
                       .AllowAnyMethod()
                       .AllowAnyHeader();
            }));
            
        }

        
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            
             ......
            app.UseCors("AllowAnyOrigins");
            .....
}

And remove all Cors headers from the javascript unless you are sure that you need them.

CORS Issue: C# API requests work for one domain, but not to the other

1 Answers1