How to get rid of CORS in .net core 2.2?

Question

I've updated my project to .net core 2.2 and it seems like CORS is making problems that weren't there in 2.1.

I'm running my app on this URL: http://*:5300

I've added this code in the Startup.cs:

public void ConfigureServices(IServiceCollection services)
{
    ...

    services.AddCors(options =>
                     options.AddPolicy("MyPolicy", builder =>
                     {
                         builder.AllowAnyOrigin()
                                .AllowAnyMethod()
                                .AllowCredentials()
                                .AllowAnyHeader();
                     }));

    services.AddMvc();

    ...
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    ...

    app.UseCors(builder =>
    {
        builder.AllowAnyOrigin()
               .AllowAnyMethod()
               .AllowCredentials()
               .AllowAnyHeader();
    });

    app.UseAuthentication();
    app.UseMvc();
}

This didn't work, so I've added on top of it the [EnableCors] attribute on my `BaseController" class:

[EnableCors]
[Authorize]
[Produces("application/json")]
[Route("api/[controller]")]
public class BaseController : Controller
{

}

But I'm still getting this CORS error:

Access to XMLHttpRequest at 'http://192.168.15.63:5301/api/permissions/UI' from origin 'http://192.168.15.63:5302' has been blocked by CORS policy:
Response to preflight request doesn't pass access control check:
The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

What else can I do in order to completely remove CORS?

Answer 1

The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

You cannot use both AllowAnyOrigin and AllowCredentials when using ASP.NET Core to respond to a CORS request.

Access to XMLHttpRequest at 'http://192.168.15.63:5301/api/permissions/UI' from origin 'http://192.168.15.63:5302' has been blocked by CORS policy

This message shows that your server is listening on http://192.168.15.63:5301, but your client is making the request from http://192.168.15.63:5302. Since the port is different, these are different origins and therefore CORS protection is used.

To allow the request to succeed, update your ASP.NET CORS configuration code to something like the following:

builder.WithOrigins("http://192.168.15.63:5302")
    .AllowAnyMethod()
    .AllowCredentials()
    .AllowAnyHeader();

This configures the origin of the client as being supported by CORS - you could, of course, add this as a configuration option to the application itself (using e.g. appsettings.json), if needed.

---

Aside:

As you've called AddCors and configured a named policy, there is no reason to configure the same policy in the call to UseCors - you can simply pass in the name of the policy you configured earlier with AddCors:

app.UseCors("MyPolicy");