-1

I'm traing to create an angular app

Well, when I call the API from Postman it work but when I try to call it using HTTP.put on a browser (firefox or chrome ) I always have this error

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://localhost:5001/api/users/set-main-photo/25. (Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’).

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://localhost:5001/api/users/set-main-photo/25. (Reason: CORS request did not succeed).

I make some research and I addid this to my header using the Interceptor Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD Access-Control-Allow-Origin: *

still same issue

any help please?

Note : HTTP.GET and HTTP.POST works fine Thank you

Rad
  • 4,403
  • 4
  • 24
  • 25
  • 2
    Have you read and understood the following? https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS – jub0bs Oct 22 '21 at 09:47
  • Does this answer your question? [Why does my http://localhost CORS origin not work?](https://stackoverflow.com/questions/10883211/why-does-my-http-localhost-cors-origin-not-work) – Liam Oct 22 '21 at 09:53

2 Answers2

-1

You've run into a common issue when starting out with development. Due to security issues you are restricted from calls across domain names without it being explicitly configured to do so. Depending on your API you can allow any origin to call it.

Setting the headers on your request itself will not allow you to bypass this restriction you need to configure the API.

You can read https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS to get a better understanding.

Or as stated above this previous post covers the topic as well https://stackoverflow.com/a/10892392/9994146

Stephen
  • 47
  • 6
-1

I resolve this using

  app.UseCors(x => x
                .AllowAnyMethod()
                .AllowAnyHeader()
                .SetIsOriginAllowed(origin => true) // allow any origin
                .AllowCredentials()); // allow credentials

before it was

 app.UseCors( x => x.AllowAnyHeader().AllowAnyHeader().WithOrigins("https://localhost:4200"));

Thank you

Rad
  • 4,403
  • 4
  • 24
  • 25
  • 1
    You're allowing arbitrary origins with credentials. This is very insecure! You're basically throwing the Same-Origin Policy out the window. You should reconsider. – jub0bs Oct 22 '21 at 14:35
  • Yes but now i'm in localhost so no problem then I think, i'm still in dev any way thank you – Rad Oct 23 '21 at 07:57