.Net 5 Web API CORS LocalHost

Question

I am building a .Net 5 Web API and I am having issues with CORS only when I am running locally (aka localhost). When I have deployed my app to Azure I can access my API just fine from my Blazor app.

Class Startup.cs

readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";

Class: Startup.cs
Method: ConfigureServices

services.AddCors(options =>
{
    //didn't work
    //options.AddDefaultPolicy(builder =>
    //{
    //    builder.SetIsOriginAllowed(origin => new Uri(origin).Host == "localhost");
    //});

    options.AddPolicy(name: MyAllowSpecificOrigins,
                      builder =>
                      {
                          builder.WithOrigins("https://localhost:44373/", "https://myawesomesite")
                          .AllowAnyMethod()
                          .AllowAnyHeader()
                          .AllowCredentials();
                      });
});

Class: Startup.cs
Method: Configure

app.UseCors(MyAllowSpecificOrigins);

We had exactly the same problem with Angular App + WebAPI server. Don't remember the exact reason (I think something with ports in headers), therefore cannot post an answer. As a workaround we started Chrome with the Angular app from cmd with --disable-web-security --user-data-dir="c:/tmp/chrome" parameters. Than it won't care about CORS. — Maxim Zabolotskikh, Feb 08 '21 at 12:31
This solution was working, then I worked the project from a different computer, once I merged back I have been getting CORS problems. — Travis Pettry, Feb 08 '21 at 12:33
The one I have mentioned in the answer is working fine on my side and we are testing our API via POSTMAN and the from frontend as well using axios. — Bilal Mehrban, Feb 08 '21 at 12:39
Blazor runs in Browser, right? Postman does not care about CORS. Browser (AFAIK Chrome at least) does not support localhost as a valid origin, so it fails. See also here: https://stackoverflow.com/questions/10883211/deadly-cors-when-http-localhost-is-the-origin — Maxim Zabolotskikh, Feb 08 '21 at 12:51

score 8 · Accepted Answer · edited Jul 19 '22 at 13:18

8

Just remove trailing "/" from your local host url and for the test you can try to remove .AllowCredentials().

And use this syntax:

services.AddCors(o => o.AddPolicy(MyAllowSpecificOrigins,
                      builder =>
                      {
                          builder.WithOrigins("https://localhost:44373", 
                              "https://myawesomesite")
                          .AllowAnyMethod()
                          .AllowAnyHeader();
                      }));

and your UseCors method should be between UseRouting and UseAuthourization


app.UseRouting()
....
.....
app.UseCors(MyAllowSpecificOrigins);

....
....
app.UseAuthorization(); // if you need the one

edited Jul 19 '22 at 13:18

spottedmahn

14,823
13
108
178

answered Feb 08 '21 at 12:51

Serge

40,935
4
18
45

This works for Brave and not FireFox. Thanks! – Travis Pettry Feb 08 '21 at 13:10
Thank you so much! this worked perfectly – Anjali Rana Jun 20 '23 at 01:46

Bilal Mehrban · Answer 2 · 2021-02-08T12:37:04.273

2

What I have on my side working properly as below.

Class: Startup.cs

Method: ConfigureServices

services.AddCors(c =>  
  { 
    c.AddPolicy("AllowOrigin", options => options.AllowAnyOrigin());  
  });

Class: Startup.cs

Method: Configure

app.UseCors(options => options.AllowAnyOrigin());

Try this, let me know if it helps.

edited Feb 08 '21 at 12:37

answered Feb 08 '21 at 12:26

Bilal Mehrban

638
6
15

No dice, same issue – Travis Pettry Feb 08 '21 at 12:29
How about know, I have updated the answer. try again. – Bilal Mehrban Feb 08 '21 at 12:37
No dice, same issue – Travis Pettry Feb 08 '21 at 12:39
have you tried a clean build? a different browser? postman? or tried clearing the browser cache? – Bilal Mehrban Feb 08 '21 at 12:40
I've tried all of that with no success, but, postman seems to be working – Travis Pettry Feb 08 '21 at 12:49
Well quite strange, please wait for a senior community member to answer. – Bilal Mehrban Feb 08 '21 at 13:02
2

Postman is always working since only the browser checks Cors but postman doesn't. – Serge Feb 08 '21 at 13:05

.Net 5 Web API CORS LocalHost

2 Answers2