blocks|key|129018|text|对于ASP.NET核心6：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|129019|var++MyAllowSpecificOrigins+=+"_myAllowSpecificOrigins";

var+builder+=+WebApplication.CreateBuilder(args);

builder.Services.AddCors(options+=>
{
++++options.AddPolicy(name:+MyAllowSpecificOrigins,
++++++++++++++++++++++builder+=>
++++++++++++++++++++++{
++++++++++++++++++++++++++builder.WithOrigins("http://example.com",
++++++++++++++++++++++++++++++++++++++++++++++"http://www.contoso.com");
++++++++++++++++++++++});
});

//+services.AddResponseCaching();

builder.Services.AddControllers();

var+app+=+builder.Build();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();

app.UseCors(MyAllowSpecificOrigins);

app.UseAuthorization();

app.MapControllers();

app.Run();|code-block|syntax|javascript|129020|有关更多示例，请参阅official+docs。|offset|length|129021|对于ASP.NET核心3.1和5.0：|129022|您需要在应用程序启动时通过ConfigureServices方法配置CORS策略：|style|CODE|129023|public+void+ConfigureServices(IServiceCollection+services)
{
++++services.AddCors(o+=>+o.AddPolicy("MyPolicy",+builder+=>
++++{
++++++++builder.WithOrigins("http://example.com")
+++++++++++++++.AllowAnyMethod()
+++++++++++++++.AllowAnyHeader();
++++}));

++++//+...
}|129024|builder中的CorsPolicyBuilder允许您根据需要配置策略。现在，您可以使用此名称将策略应用于控制器和操作：|129025|[EnableCors("MyPolicy")]|129026|或者将其应用于每个请求：|129027|public+void+Configure(IApplicationBuilder+app)
{
++++app.UseCors("MyPolicy");

++++//+...

++++//+This+should+always+be+called+last+to+ensure+that
++++//+middleware+is+registered+in+the+correct+order.
++++app.UseMvc();
}|129028|entityMap|0|LINK|mutability|MUTABLE|url|https://docs.microsoft.com/en-us/aspnet/core/security/cors^0|0|0|A|D|0|0|0|D|H|0|0|0|7|9|H|0|0|0|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|19|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|1A|8|@]|9|@$I|1B|J|1C|1|1D]]|A|$]]|$1|K|3|L|5|6|7|1E|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|1F|8|@$I|1G|J|1H|O|P]]|9|@]|A|$]]|$1|Q|3|R|5|D|7|1I|8|@]|9|@]|A|$E|F]]|$1|S|3|T|5|6|7|1J|8|@$I|1K|J|1L|O|P]|$I|1M|J|1N|O|P]]|9|@]|A|$]]|$1|U|3|V|5|D|7|1O|8|@]|9|@]|A|$E|F]]|$1|W|3|X|5|6|7|1P|8|@]|9|@]|A|$]]|$1|Y|3|Z|5|D|7|1Q|8|@]|9|@]|A|$E|F]]|$1|10|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]]|11|$12|$5|13|14|15|A|$16|17]]]]

For ASP.NET Core 6:
<pre><code>var MyAllowSpecificOrigins = &quot;_myAllowSpecificOrigins&quot;;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCors(options =&gt;
{
 options.AddPolicy(name: MyAllowSpecificOrigins,
 builder =&gt;
 {
 builder.WithOrigins(&quot;http://example.com&quot;,
 &quot;http://www.contoso.com&quot;);
 });
});

// services.AddResponseCaching();

builder.Services.AddControllers();

var app = builder.Build();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();

app.UseCors(MyAllowSpecificOrigins);

app.UseAuthorization();

app.MapControllers();

app.Run();
</code></pre>
See the See the <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cors" rel="noreferrer">official docs</a> for more samples.
For ASP.NET Core 3.1 and 5.0:
You have to configure a CORS policy at application startup in the <code>ConfigureServices</code> method:
<pre><code>public void ConfigureServices(IServiceCollection services)
{
 services.AddCors(o =&gt; o.AddPolicy(&quot;MyPolicy&quot;, builder =&gt;
 {
 builder.WithOrigins(&quot;http://example.com&quot;)
 .AllowAnyMethod()
 .AllowAnyHeader();
 }));

 // ...
}
</code></pre>
The <code>CorsPolicyBuilder</code> in <code>builder</code> allows you to configure the policy to your needs. You can now use this name to apply the policy to controllers and actions:
<pre><code>[EnableCors(&quot;MyPolicy&quot;)]
</code></pre>
Or apply it to every request:
<pre><code>public void Configure(IApplicationBuilder app)
{
 app.UseCors(&quot;MyPolicy&quot;);

 // ...

 // This should always be called last to ensure that
 // middleware is registered in the correct order.
 app.UseMvc();
}
</code></pre>

blocks|key|2903175|text|基于Henk's+answer，我已经能够想出特定的域、我想要允许的方法以及我想要为其启用CORS的头部：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2903176|public+void+ConfigureServices(IServiceCollection+services)
{
++++services.AddCors(options+=>
+++++++++options.AddPolicy("AllowSpecific",+p+=>+p.WithOrigins("http://localhost:1233")
+++++++++++++++++++++++++++++++++++++++++++++++++++.WithMethods("GET")
+++++++++++++++++++++++++++++++++++++++++++++++++++.WithHeaders("name")));
++++services.AddMvc();
}|code-block|syntax|javascript|2903177|用法：|2903178|[EnableCors("AllowSpecific")]|2903179|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/31942128/4320665^0|2|D|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|F|7|Y|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|Z|8|@]|9|@]|C|$]]|$1|K|3|L|5|F|7|10|8|@]|9|@]|C|$G|H]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]]]

Based on <a href="https://stackoverflow.com/a/31942128/4320665">Henk's answer</a> I have been able to come up with the specific domain, the method I want to allow and also the header I want to enable CORS for:

<pre><code>public void ConfigureServices(IServiceCollection services)
{
 services.AddCors(options =&gt;
 options.AddPolicy("AllowSpecific", p =&gt; p.WithOrigins("http://localhost:1233")
 .WithMethods("GET")
 .WithHeaders("name")));
 services.AddMvc();
}
</code></pre>

usage:

<pre><code>[EnableCors("AllowSpecific")]
</code></pre>

blocks|key|129055|text|适用于.NET核心1和.Net核心2|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|129056|如果使用.Net-Core+1.1|CODE|129057|不幸的是，在这个特定的案例中，文档非常混乱。所以我会让它变得非常简单：|129058|129059|将Microsoft.AspNetCore.Cors+nuget包添加到项目|unordered-list-item|129060|中|129061|添加services.AddCors();，|129062|In+ConfigureServices+method|129063|129064|129065|In+Configure方法，在调用app.UseMvc()和app.UseStaticFiles()之前，添加：|129066|129067|App.UseCors(构建器=>构建器.AllowAnyOrigin()+.AllowAnyMethod()+.AllowAnyHeader()+builder|129068|就这样。每个客户端都可以访问您的ASP.NET核心网站/应用程序接口。|129069|129070|如果使用.Net-Core+2.0|129071|129072|将Microsoft.AspNetCore.Cors+nuget包添加到项目|129073|129074|129075|in+ConfigureServices+method，在调用services.AddMvc()之前，添加：|129076|129077|services.AddCors(options+=>+{+options.AddPolicy("AllowAll"，builder+=>+{+builder+.AllowAnyOrigin()+.AllowAnyMethod()+.AllowAnyHeader()+.AllowCredentials()；})；});|129078|Configure方法中的|129079|(Important)，在调用app.UseMvc()之前添加app.UseCors("AllowAll");|129080|129081|"AllowAll"是我们需要在app.UseCors中提到的策略名称。它可以是任何名字。|129082|entityMap^0|0|I|0|4|D|0|0|0|1|P|0|0|2|J|0|3|H|0|0|0|3|9|I|C|V|K|0|0|0|0|0|4|D|0|0|1|P|0|0|0|3|H|V|H|S|1|0|0|0|0|9|0|0|B|F|C|V|O|0|0|0|A|G|B|0^^$0|@$1|2|3|4|5|6|7|1P|8|@$9|1Q|A|1R|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1S|8|@$9|1T|A|1U|B|H]]|D|@]|E|$]]|$1|I|3|J|5|6|7|1V|8|@]|D|@]|E|$]]|$1|K|3|-4|5|6|7|1W|8|@]|D|@]|E|$]]|$1|L|3|M|5|N|7|1X|8|@$9|1Y|A|1Z|B|H]]|D|@]|E|$]]|$1|O|3|P|5|6|7|20|8|@]|D|@]|E|$]]|$1|Q|3|R|5|6|7|21|8|@$9|22|A|23|B|H]]|D|@]|E|$]]|$1|S|3|T|5|N|7|24|8|@$9|25|A|26|B|H]]|D|@]|E|$]]|$1|U|3|-4|5|6|7|27|8|@]|D|@]|E|$]]|$1|V|3|-4|5|6|7|28|8|@]|D|@]|E|$]]|$1|W|3|X|5|N|7|29|8|@$9|2A|A|2B|B|H]|$9|2C|A|2D|B|H]|$9|2E|A|2F|B|H]]|D|@]|E|$]]|$1|Y|3|-4|5|6|7|2G|8|@]|D|@]|E|$]]|$1|Z|3|10|5|6|7|2H|8|@]|D|@]|E|$]]|$1|11|3|12|5|6|7|2I|8|@]|D|@]|E|$]]|$1|13|3|-4|5|6|7|2J|8|@]|D|@]|E|$]]|$1|14|3|15|5|6|7|2K|8|@$9|2L|A|2M|B|H]]|D|@]|E|$]]|$1|16|3|-4|5|6|7|2N|8|@]|D|@]|E|$]]|$1|17|3|18|5|N|7|2O|8|@$9|2P|A|2Q|B|H]]|D|@]|E|$]]|$1|19|3|P|5|6|7|2R|8|@]|D|@]|E|$]]|$1|1A|3|-4|5|6|7|2S|8|@]|D|@]|E|$]]|$1|1B|3|1C|5|N|7|2T|8|@$9|2U|A|2V|B|H]|$9|2W|A|2X|B|H]|$9|2Y|A|2Z|B|C]]|D|@]|E|$]]|$1|1D|3|-4|5|6|7|30|8|@]|D|@]|E|$]]|$1|1E|3|1F|5|6|7|31|8|@]|D|@]|E|$]]|$1|1G|3|1H|5|6|7|32|8|@$9|33|A|34|B|H]]|D|@]|E|$]]|$1|1I|3|1J|5|N|7|35|8|@$9|36|A|37|B|C]|$9|38|A|39|B|H]|$9|3A|A|3B|B|H]]|D|@]|E|$]]|$1|1K|3|-4|5|6|7|3C|8|@]|D|@]|E|$]]|$1|1L|3|1M|5|6|7|3D|8|@$9|3E|A|3F|B|H]|$9|3G|A|3H|B|H]]|D|@]|E|$]]|$1|1N|3|-4|5|6|7|3I|8|@]|D|@]|E|$]]]|1O|$]]

Applies to .NET Core 1 and .Net Core 2
If using <code>.Net-Core 1.1</code>
Unfortunately the docs are very confusing in this specific case. So I'll make it dead-simple:
<ul>
<li>Add <code>Microsoft.AspNetCore.Cors</code> nuget package to your project
</li>
<li>In <code>ConfigureServices</code> method, add <code>services.AddCors();</code>
</li>
<li>In <code>Configure</code> method, before calling <code>app.UseMvc()</code> and <code>app.UseStaticFiles()</code>, add:
<pre><code> app.UseCors(builder =&gt; builder
 .AllowAnyOrigin()
 .AllowAnyMethod()
 .AllowAnyHeader()
 .AllowCredentials());
</code></pre>
</li>
</ul>
That's it. Every client has access to your ASP.NET Core Website/API.
<hr />
If using <code>.Net-Core 2.0</code>
<ul>
<li>Add <code>Microsoft.AspNetCore.Cors</code> nuget package to your project
</li>
<li>in <code>ConfigureServices</code> method, before calling <code>services.AddMvc()</code>, add:
<pre><code> services.AddCors(options =&gt;
 {
 options.AddPolicy(&quot;AllowAll&quot;,
 builder =&gt;
 {
 builder
 .AllowAnyOrigin() 
 .AllowAnyMethod()
 .AllowAnyHeader()
 .AllowCredentials();
 });
 });
</code></pre>
</li>
<li>(Important) In <code>Configure</code> method, before calling <code>app.UseMvc()</code>, add <code>app.UseCors(&quot;AllowAll&quot;);</code>
<code>&quot;AllowAll&quot;</code> is the policy name which we need to mention in <code>app.UseCors</code>. It could be any name.
</li>
</ul>

blocks|key|2691065|text|public+void+ConfigureServices(IServiceCollection+services)
{
++++services.AddCors(options+=>
++++{
++++++++options.AddPolicy("AllowAnyOrigin",
++++++++++++builder+=>+builder
++++++++++++.AllowAnyOrigin()
++++++++++++.AllowAnyMethod()
++++++++++++.AllowAnyHeader());
++++});

++++services.Configure<MvcOptions>(options+=>+{
++++++++options.Filters.Add(new+CorsAuthorizationFilterFactory("AllowAnyOrigin"));
++++});++++++++++++
}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|2691066|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services)
{
 services.AddCors(options =&gt;
 {
 options.AddPolicy(&quot;AllowAnyOrigin&quot;,
 builder =&gt; builder
 .AllowAnyOrigin()
 .AllowAnyMethod()
 .AllowAnyHeader());
 });

 services.Configure&lt;MvcOptions&gt;(options =&gt; {
 options.Filters.Add(new CorsAuthorizationFilterFactory(&quot;AllowAnyOrigin&quot;));
 }); 
}
</code></pre>

blocks|key|131200|text|您必须在Startup.cs类中配置|type|unstyled|depth|inlineStyleRanges|entityRanges|data|131201|blockquote|131202|131203|services.AddCors(options+=>
++++++++{
++++++++++++options.AddPolicy("CorsPolicy",
++++++++++++++++builder+=>+builder.AllowAnyOrigin()
++++++++++++++++.AllowAnyMethod()
++++++++++++++++.AllowAnyHeader()
++++++++++++++++.AllowCredentials());
++++++++});|code-block|syntax|javascript|131204|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|-4|5|C|7|M|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|N|8|@]|9|@]|A|$]]|$1|E|3|F|5|G|7|O|8|@]|9|@]|A|$H|I]]|$1|J|3|-4|5|6|7|P|8|@]|9|@]|A|$]]]|K|$]]

<blockquote>
 You have to configure in Startup.cs class 
</blockquote>

<pre><code>services.AddCors(options =&gt;
 {
 options.AddPolicy("CorsPolicy",
 builder =&gt; builder.AllowAnyOrigin()
 .AllowAnyMethod()
 .AllowAnyHeader()
 .AllowCredentials());
 });
</code></pre>

blocks|key|129104|text|如果您在IIS上托管，一个可能的原因是您会得到这是因为IIS正在阻止OPTIONS谓词。为此，我花了将近一个小时的时间：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|129105|一个可以说明问题的迹象是，在OPTIONS请求期间，您收到了404错误。|129106|要解决此问题，您需要显式地告诉IIS+not阻止OPTIONS请求。|BOLD|129107|转到请求筛选：|129108|​|129109|📷|atomic|129110|129111|确保允许选项：|129112|129113|129114|129115|或者，只需使用以下设置创建一个+web.config+：|129116|<system.webServer>
++++<security>
++++++++<requestFiltering>
++++++++++++<verbs>
++++++++++++++++<remove+verb="OPTIONS"+/>
++++++++++++++++<add+verb="OPTIONS"+allowed="true"+/>
++++++++++++</verbs>
++++++++</requestFiltering>
++++</security>
</system.webServer>|code-block|syntax|javascript|129117|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/67d224ba32f444a5d0d47a6a9d16e27f.png|imageAlt|1|https://ask.qcloudimg.com/http-save/yehe-900000/53c93edf6056417dd2132971af2527fa.png^0|Y|7|0|E|7|U|3|0|J|3|O|7|0|0|7|0|0|0|1|0|0|0|0|7|0|0|0|1|1|0|0|G|A|R|1|G|A|0|0^^$0|@$1|2|3|4|5|6|7|1F|8|@$9|1G|A|1H|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1I|8|@$9|1J|A|1K|B|C]|$9|1L|A|1M|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|1N|8|@$9|1O|A|1P|B|J]|$9|1Q|A|1R|B|C]]|D|@]|E|$]]|$1|K|3|L|5|6|7|1S|8|@$9|1T|A|1U|B|J]]|D|@]|E|$]]|$1|M|3|N|5|6|7|1V|8|@]|D|@]|E|$]]|$1|O|3|P|5|Q|7|1W|8|@]|D|@$9|1X|A|1Y|1|1Z]]|E|$]]|$1|R|3|N|5|6|7|20|8|@]|D|@]|E|$]]|$1|S|3|T|5|6|7|21|8|@$9|22|A|23|B|J]]|D|@]|E|$]]|$1|U|3|N|5|6|7|24|8|@]|D|@]|E|$]]|$1|V|3|P|5|Q|7|25|8|@]|D|@$9|26|A|27|1|28]]|E|$]]|$1|W|3|N|5|6|7|29|8|@]|D|@]|E|$]]|$1|X|3|Y|5|6|7|2A|8|@$9|2B|A|2C|B|J]|$9|2D|A|2E|B|J]|$9|2F|A|2G|B|C]]|D|@]|E|$]]|$1|Z|3|10|5|11|7|2H|8|@]|D|@]|E|$12|13]]|$1|14|3|-4|5|6|7|2I|8|@]|D|@]|E|$]]]|15|$16|$5|17|18|19|E|$1A|1B|1C|-4]]|1D|$5|17|18|19|E|$1A|1E|1C|-4]]]]

If you are hosting on IIS, one possible reason is you are getting this is because IIS is blocking <code>OPTIONS</code> verb. I spent almost an hour because of this:

One telltale indication is you are getting <code>404</code> error during <code>OPTIONS</code> request.

To fix this, you need to explicitly tell IIS not to block <code>OPTIONS</code> request.

Go to Request Filtering:

<a href="https://i.stack.imgur.com/K9Gu4.png" rel="noreferrer"><img src="https://i.stack.imgur.com/K9Gu4.png" alt="IIS Request Filtering"></a>

Make sure OPTIONS is allowed:

<a href="https://i.stack.imgur.com/e20to.png" rel="noreferrer"><img src="https://i.stack.imgur.com/e20to.png" alt="Make sure OPTIONS is True"></a>

Or, just create a <code>web.config</code> with the following setting:

<pre><code>&lt;system.webServer&gt;
 &lt;security&gt;
 &lt;requestFiltering&gt;
 &lt;verbs&gt;
 &lt;remove verb="OPTIONS" /&gt;
 &lt;add verb="OPTIONS" allowed="true" /&gt;
 &lt;/verbs&gt;
 &lt;/requestFiltering&gt;
 &lt;/security&gt;
&lt;/system.webServer&gt;
</code></pre>

blocks|key|2691119|text|具体地说，在带有SignalR的dotnet+core+2.2中，您必须更改|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2691120|.WithOrigins("http://localhost:3000")或|offset|length|style|CODE|2691121|.SetIsOriginAllowed(isOriginAllowed:+_+=>+true)+//for+all+origins|2691122|而是使用.AllowCredentials()进行.AllowAnyOrigin()|2691123|https://trailheadtechnology.com/breaking-change-in-aspnetcore-2-2-for-signalr-and-cors/|2691124|https://github.com/aspnet/AspNetCore/issues/4483|2691125|entityMap|0|LINK|mutability|MUTABLE|url|1^0|0|0|11|0|0|1T|0|4|J|P|H|0|0|2F|0|0|0|1C|1|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@$D|Z|E|10|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|11|8|@$D|12|E|13|F|G]]|9|@]|A|$]]|$1|J|3|K|5|6|7|14|8|@$D|15|E|16|F|G]|$D|17|E|18|F|G]]|9|@]|A|$]]|$1|L|3|M|5|6|7|19|8|@]|9|@$D|1A|E|1B|1|1C]]|A|$]]|$1|N|3|O|5|6|7|1D|8|@]|9|@$D|1E|E|1F|1|1G]]|A|$]]|$1|P|3|-4|5|6|7|1H|8|@]|9|@]|A|$]]]|Q|$R|$5|S|T|U|A|$V|M]]|W|$5|S|T|U|A|$V|O]]]]

Specifically in dotnet core 2.2 with SignalR you must change 

<code>.WithOrigins("http://localhost:3000")</code> or 

<code>.SetIsOriginAllowed(isOriginAllowed: _ =&gt; true) //for all origins</code> 

instead <code>.AllowAnyOrigin()</code> with <code>.AllowCredentials()</code>

<a href="https://trailheadtechnology.com/breaking-change-in-aspnetcore-2-2-for-signalr-and-cors/" rel="noreferrer">https://trailheadtechnology.com/breaking-change-in-aspnetcore-2-2-for-signalr-and-cors/</a>

<a href="https://github.com/aspnet/AspNetCore/issues/4483" rel="noreferrer">https://github.com/aspnet/AspNetCore/issues/4483</a>

blocks|key|2691132|text|上面提到的所有解决方法都可能工作，也可能不工作，在大多数情况下都不会工作。我已经在这里给出了解决方案|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2691133|Currently+I+am+working+on+Angular+and+Web+API(.net+Core)+and+came+across+CORS+issue+explained+below|offset|length|2691134|上面提供的解决方案将始终有效。对于'OPTIONS‘请求，确实有必要启用’匿名身份验证‘。使用这里提到的解决方案，您不必执行上面提到的所有步骤，如IIS设置。|2691135|无论如何，有人将我上面的文章标记为与这篇文章重复，但我可以看到这篇文章只是为了在ASP.net核心中启用CORS，但我的文章是与在ASP.net核心和Angular中启用和实现CORS相关的。|2691136|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/57060019/currently-i-am-working-on-angular-and-web-api-net-core-and-came-across-cors-is^0|0|0|2R|0|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|G|5|6|7|W|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|X|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

All the workaround mentioned above may work or may not work, in most cases it will not work. I have given the solution here 

<a href="https://stackoverflow.com/questions/57060019/currently-i-am-working-on-angular-and-web-api-net-core-and-came-across-cors-is">Currently I am working on Angular and Web API(.net Core) and came across CORS issue explained below</a>

The solution provided above will always work. With 'OPTIONS' request it is really necessary to enable 'Anonymous Authentication'. With the solution mentioned here you don't have to do all the steps mentioned above, like IIS settings.

Anyways someone marked my above post as duplicate with this post, but I can see that this post is only to enable CORS in ASP.net Core, but my post is related to, Enabling and implementing CORS in ASP.net Core and Angular.

blocks|key|2903320|text|步骤1:我们的项目中需要Microsoft.AspNetCore.Cors包。对于安装，请转到Tools+->+NuGet+Package+Manager+->+Manage+NuGet+Packages+For+Solution。搜索Microsoft.AspNetCore.Cors并安装软件包。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2903321|步骤2:我们需要将CORS注入到容器中，以便应用程序可以使用它。在Startup.cs类中，让我们转到ConfigureServices方法并注册CORS。|2903322|​|2903323|📷|atomic|offset|length|2903324|2903325|因此，在我们的服务器应用程序中，让我们转到Controllers+->+HomeController.cs，并将EnableCors装饰器添加到索引方法(或您特定的控制器和操作)：|2903326|2903327|2903328|2903329|有关详细信息，请参阅Click+Here|2903330|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/88328dbf9540ce5b725a67da7638d30b.png|imageAlt|1|https://ask.qcloudimg.com/http-save/yehe-900000/d5ff7c19ff4a3a3354a499fee2a2e4cb.png|2|LINK|MUTABLE|url|http://shebin.tech/enabling-cors-in-asp-net-core/^0|0|0|0|0|1|0|0|0|0|0|0|1|1|0|0|A|A|2|0^^$0|@$1|2|3|4|5|6|7|18|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|19|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1A|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|1B|8|@]|9|@$I|1C|J|1D|1|1E]]|A|$]]|$1|K|3|E|5|6|7|1F|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1G|8|@]|9|@]|A|$]]|$1|N|3|E|5|6|7|1H|8|@]|9|@]|A|$]]|$1|O|3|G|5|H|7|1I|8|@]|9|@$I|1J|J|1K|1|1L]]|A|$]]|$1|P|3|E|5|6|7|1M|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1N|8|@]|9|@$I|1O|J|1P|1|1Q]]|A|$]]|$1|S|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]]|T|$U|$5|V|W|X|A|$Y|Z|10|-4]]|11|$5|V|W|X|A|$Y|12|10|-4]]|13|$5|14|W|15|A|$16|17]]]]

Step 1: We need Microsoft.AspNetCore.Cors package in our project. For installing go to Tools -> NuGet Package Manager -> Manage NuGet Packages for Solution. Search for Microsoft.AspNetCore.Cors and install the package.

Step 2: We need to inject CORS into the container so that it can be used by the application. In Startup.cs class, let’s go to the ConfigureServices method and register CORS.

<a href="https://i.stack.imgur.com/3AgCw.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3AgCw.png" alt="enter image description here"></a>

So, in our server app, let’s go to Controllers -> HomeController.cs and add the EnableCors decorator to the Index method (Or your specific controller and action):

<a href="https://i.stack.imgur.com/0AjLG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0AjLG.png" alt="enter image description here"></a>

For More Detail <a href="http://shebin.tech/enabling-cors-in-asp-net-core/" rel="nofollow noreferrer">Click Here</a>

blocks|key|2903345|text|在.NET+Core3.1中实现此功能，如下所示|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2903346|请确保将UseCors代码放在app.UseRouting();和|CODE|2903347|之间|ordered-list-item|2903348|2903349|app.UseHttpsRedirection();

app.UseRouting();
app.UseCors("CorsApi");

app.UseAuthentication();
app.UseAuthorization();

app.UseEndpoints(endpoints+=>+{
++++endpoints.MapControllers();
});|code-block|syntax|javascript|2903350|然后，|2903351|将此代码放入ConfigureServices+method|2903352|中|2903353|services.AddCors(options+=>
{
++++options.AddPolicy("CorsApi",
++++++++builder+=>+builder.WithOrigins("http://localhost:4200",+"http://mywebsite.com")
++++++++++++.AllowAnyHeader()
++++++++++++.AllowAnyMethod());
});|2903354|2903355|，在基本控制器之上，我放置了这个|2903356|2903357|[EnableCors("CorsApi")]
[Route("api/[controller]")]
[ApiController]
public+class+BaseController+:+ControllerBase|2903358|现在，我的所有控制器都将从BaseController继承，并启用CORS|2903359|entityMap^0|1|C|0|4|7|F|H|0|0|0|0|0|6|H|0|0|0|0|0|0|0|D|E|0^^$0|@$1|2|3|4|5|6|7|19|8|@$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1C|8|@$9|1D|A|1E|B|H]|$9|1F|A|1G|B|H]]|D|@]|E|$]]|$1|I|3|J|5|K|7|1H|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]|$1|M|3|N|5|O|7|1J|8|@]|D|@]|E|$P|Q]]|$1|R|3|S|5|6|7|1K|8|@]|D|@]|E|$]]|$1|T|3|U|5|K|7|1L|8|@$9|1M|A|1N|B|H]]|D|@]|E|$]]|$1|V|3|W|5|6|7|1O|8|@]|D|@]|E|$]]|$1|X|3|Y|5|O|7|1P|8|@]|D|@]|E|$P|Q]]|$1|Z|3|-4|5|6|7|1Q|8|@]|D|@]|E|$]]|$1|10|3|11|5|K|7|1R|8|@]|D|@]|E|$]]|$1|12|3|-4|5|6|7|1S|8|@]|D|@]|E|$]]|$1|13|3|14|5|O|7|1T|8|@]|D|@]|E|$P|Q]]|$1|15|3|16|5|6|7|1U|8|@$9|1V|A|1W|B|H]]|D|@]|E|$]]|$1|17|3|-4|5|6|7|1X|8|@]|D|@]|E|$]]]|18|$]]

Got this working with .NET Core 3.1 as follows
<ol>
<li>Make sure you place the <code>UseCors</code> code between <code>app.UseRouting();</code> and <code>app.UseAuthentication();</code></li>
</ol>
<pre class="lang-cs prettyprint-override"><code>app.UseHttpsRedirection();

app.UseRouting();
app.UseCors(&quot;CorsApi&quot;);

app.UseAuthentication();
app.UseAuthorization();

app.UseEndpoints(endpoints =&gt; {
 endpoints.MapControllers();
});
</code></pre>
<ol start="2">
<li>Then place this code in the <code>ConfigureServices</code> method</li>
</ol>
<pre class="lang-cs prettyprint-override"><code>services.AddCors(options =&gt;
{
 options.AddPolicy(&quot;CorsApi&quot;,
 builder =&gt; builder.WithOrigins(&quot;http://localhost:4200&quot;, &quot;http://mywebsite.com&quot;)
 .AllowAnyHeader()
 .AllowAnyMethod());
});
</code></pre>
<ol start="3">
<li>And above the base controller I placed this</li>
</ol>
<pre class="lang-cs prettyprint-override"><code>[EnableCors(&quot;CorsApi&quot;)]
[Route(&quot;api/[controller]&quot;)]
[ApiController]
public class BaseController : ControllerBase
</code></pre>
Now all my controllers will inherit from the <code>BaseController</code> and will have CORS enabled

blocks|key|128223|text|如果您收到错误消息"No+'Access-Control-Allow-Origin‘header+is+present+on+the+requested’“。特别是对于PUT和DELETE请求，您可以尝试在IIS上禁用WebDAV。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|128224|显然，默认情况下WebDAVModule是启用的，默认情况下会禁用PUT和DELETE请求。|128225|要禁用WebDAVModule，请在您的web.config中添加以下内容：|128226|<system.webServer>
++<modules+runAllManagedModulesForAllRequests="false">
++++<remove+name="WebDAVModule"+/>
++</modules>
</system.webServer>|code-block|syntax|javascript|128227|entityMap^0|2C|3|2G|6|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]|$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|V|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|W|8|@]|D|@]|E|$]]|$1|J|3|K|5|L|7|X|8|@]|D|@]|E|$M|N]]|$1|O|3|-4|5|6|7|Y|8|@]|D|@]|E|$]]]|P|$]]

In case you get the error &quot;No 'Access-Control-Allow-Origin' header is present on the requested resource.&quot; Specifically for PUT and DELETE requests, you could try to disable WebDAV on IIS.
Apparently, the WebDAVModule is enabled by default and is disabling PUT and DELETE requests by default.
To disable the WebDAVModule, add this to your web.config:
<pre class="lang-xml prettyprint-override"><code>&lt;system.webServer&gt;
 &lt;modules runAllManagedModulesForAllRequests=&quot;false&quot;&gt;
 &lt;remove name=&quot;WebDAVModule&quot; /&gt;
 &lt;/modules&gt;
&lt;/system.webServer&gt;
</code></pre>

blocks|key|2691361|text|您可以通过三种方式启用CORS：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2691362|2691363|In+middleware使用命名策略或默认策略。|unordered-list-item|offset|length|style|BOLD|2691364|使用endpoint路由。|2691365|使用启用E211属性。|2691366|2691367|使用命名策略启用CORS：|2691368|public+class+Startup
{
++++readonly+string+CorsPolicy+=+"_corsPolicy";

++++public+void+ConfigureServices(IServiceCollection+services)
++++{
++++++++services.AddCors(options+=>
++++++++{
++++++++++++options.AddPolicy(name:+CorsPolicy,
++++++++++++++++++++++++++++++builder+=>
++++++++++++++++++++++++++++++{
+++++++++++++++++++++++++++++++++builder.AllowAnyOrigin()
++++++++++++++++++++++++++++++++++++++.AllowAnyMethod()
++++++++++++++++++++++++++++++++++++++.AllowAnyHeader()
++++++++++++++++++++++++++++++++++++++.AllowCredentials();
++++++++++++++++++++++++++++++});
++++++++});

++++++++//+services.AddResponseCaching();
++++++++services.AddControllers();
++++}

++++public+void+Configure(IApplicationBuilder+app,+IWebHostEnvironment+env)
++++{
++++++++app.UseRouting();

++++++++app.UseCors(CorsPolicy);

++++++++//+app.UseResponseCaching();

++++++++app.UseAuthorization();

++++++++app.UseEndpoints(endpoints+=>
++++++++{
++++++++++++endpoints.MapControllers();
++++++++});
++++}
}|code-block|syntax|javascript|2691369|使用UseResponseCaching.时，必须在UseResponseCaching之前调用|2691370|+UseCors|blockquote|2691371|2691372|2691373|使用默认策略启用CORS：|2691374|public+class+Startup
{
++++public+void+ConfigureServices(IServiceCollection+services)
++++{
++++++++services.AddCors(options+=>
++++++++{
++++++++++++options.AddDefaultPolicy(
++++++++++++++++builder+=>
++++++++++++++++{
+++++++++++++++++++++builder.AllowAnyOrigin()
++++++++++++++++++++++++++++++++++++++.AllowAnyMethod()
++++++++++++++++++++++++++++++++++++++.AllowAnyHeader()
++++++++++++++++++++++++++++++++++++++.AllowCredentials();
++++++++++++++++});
++++++++});

++++++++services.AddControllers();
++++}

++++public+void+Configure(IApplicationBuilder+app,+IWebHostEnvironment+env)
++++{
++++++++app.UseRouting();

++++++++app.UseCors();

++++++++app.UseAuthorization();

++++++++app.UseEndpoints(endpoints+=>
++++++++{
++++++++++++endpoints.MapControllers();
++++++++});
++++}
}|2691375|使用端点启用+CORS|2691376|public+class+Startup
{
++++readonly+string+CorsPolicy+=+"_corsPolicy+";

++++public+void+ConfigureServices(IServiceCollection+services)
++++{
++++++++services.AddCors(options+=>
++++++++{
++++++++++++options.AddPolicy(name:+CorsPolicy,
++++++++++++++++++++++++++++++builder+=>
++++++++++++++++++++++++++++++{
++++++++++++++++++++++++++++++++++builder.AllowAnyOrigin()
++++++++++++++++++++++++++++++++++++++.AllowAnyMethod()
++++++++++++++++++++++++++++++++++++++.AllowAnyHeader()
++++++++++++++++++++++++++++++++++++++.AllowCredentials();
++++++++++++++++++++++++++++++});
++++++++});

++++++++services.AddControllers();
++++}

++++public+void+Configure(IApplicationBuilder+app,+IWebHostEnvironment+env)
++++{
++++++++app.UseRouting();

++++++++app.UseCors();

++++++++app.UseAuthorization();

++++++++app.UseEndpoints(endpoints+=>
++++++++{
++++++++++++endpoints.MapControllers()
+++++++++++++++++++++.RequireCors(CorsPolicy)
++++++++});
++++}
}|2691377|使用属性启用CORS|2691378|你有两个选择|2691379|2691380|EnableCors指定默认policy.|2691381|EnableCors("{Policy字符串}“)指定命名策略。|2691382|2691383|entityMap^0|0|0|3|A|0|2|8|0|2|9|0|0|0|D|0|0|0|1C|0|1|7|0|0|0|0|D|0|0|0|4|6|5|0|0|0|A|0|0|6|0|0|0|L|0|0|W|0|0^^$0|@$1|2|3|4|5|6|7|1M|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|1N|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|1O|8|@$F|1P|G|1Q|H|I]]|9|@]|A|$]]|$1|J|3|K|5|E|7|1R|8|@$F|1S|G|1T|H|I]]|9|@]|A|$]]|$1|L|3|M|5|E|7|1U|8|@$F|1V|G|1W|H|I]]|9|@]|A|$]]|$1|N|3|-4|5|6|7|1X|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1Y|8|@$F|1Z|G|20|H|I]]|9|@]|A|$]]|$1|Q|3|R|5|S|7|21|8|@]|9|@]|A|$T|U]]|$1|V|3|W|5|6|7|22|8|@$F|23|G|24|H|I]]|9|@]|A|$]]|$1|X|3|Y|5|Z|7|25|8|@$F|26|G|27|H|I]]|9|@]|A|$]]|$1|10|3|-4|5|6|7|28|8|@]|9|@]|A|$]]|$1|11|3|-4|5|6|7|29|8|@]|9|@]|A|$]]|$1|12|3|13|5|6|7|2A|8|@$F|2B|G|2C|H|I]]|9|@]|A|$]]|$1|14|3|15|5|S|7|2D|8|@]|9|@]|A|$T|U]]|$1|16|3|17|5|6|7|2E|8|@$F|2F|G|2G|H|I]|$F|2H|G|2I|H|I]]|9|@]|A|$]]|$1|18|3|19|5|S|7|2J|8|@]|9|@]|A|$T|U]]|$1|1A|3|1B|5|6|7|2K|8|@$F|2L|G|2M|H|I]]|9|@]|A|$]]|$1|1C|3|1D|5|6|7|2N|8|@$F|2O|G|2P|H|I]]|9|@]|A|$]]|$1|1E|3|-4|5|6|7|2Q|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|E|7|2R|8|@$F|2S|G|2T|H|I]]|9|@]|A|$]]|$1|1H|3|1I|5|E|7|2U|8|@$F|2V|G|2W|H|I]]|9|@]|A|$]]|$1|1J|3|-4|5|6|7|2X|8|@]|9|@]|A|$]]|$1|1K|3|-4|5|6|7|2Y|8|@]|9|@]|A|$]]]|1L|$]]

you have three ways to enable CORS:
<ul>
<li>In middleware using a named policy or default policy.</li>
<li>Using endpoint routing.</li>
<li>With the [EnableCors] attribute.</li>
</ul>
Enable CORS with named policy:
<pre><code>public class Startup
{
 readonly string CorsPolicy = &quot;_corsPolicy&quot;;

 public void ConfigureServices(IServiceCollection services)
 {
 services.AddCors(options =&gt;
 {
 options.AddPolicy(name: CorsPolicy,
 builder =&gt;
 {
 builder.AllowAnyOrigin()
 .AllowAnyMethod()
 .AllowAnyHeader()
 .AllowCredentials();
 });
 });

 // services.AddResponseCaching();
 services.AddControllers();
 }

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 {
 app.UseRouting();

 app.UseCors(CorsPolicy);

 // app.UseResponseCaching();

 app.UseAuthorization();

 app.UseEndpoints(endpoints =&gt;
 {
 endpoints.MapControllers();
 });
 }
}
</code></pre>
<blockquote>
UseCors must be called before UseResponseCaching when using UseResponseCaching.
</blockquote>
Enable CORS with default policy:
<pre><code>public class Startup
{
 public void ConfigureServices(IServiceCollection services)
 {
 services.AddCors(options =&gt;
 {
 options.AddDefaultPolicy(
 builder =&gt;
 {
 builder.AllowAnyOrigin()
 .AllowAnyMethod()
 .AllowAnyHeader()
 .AllowCredentials();
 });
 });

 services.AddControllers();
 }

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 {
 app.UseRouting();

 app.UseCors();

 app.UseAuthorization();

 app.UseEndpoints(endpoints =&gt;
 {
 endpoints.MapControllers();
 });
 }
}
</code></pre>
Enable CORS with endpoint
<pre><code>public class Startup
{
 readonly string CorsPolicy = &quot;_corsPolicy &quot;;

 public void ConfigureServices(IServiceCollection services)
 {
 services.AddCors(options =&gt;
 {
 options.AddPolicy(name: CorsPolicy,
 builder =&gt;
 {
 builder.AllowAnyOrigin()
 .AllowAnyMethod()
 .AllowAnyHeader()
 .AllowCredentials();
 });
 });

 services.AddControllers();
 }

 public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 {
 app.UseRouting();

 app.UseCors();

 app.UseAuthorization();

 app.UseEndpoints(endpoints =&gt;
 {
 endpoints.MapControllers()
 .RequireCors(CorsPolicy)
 });
 }
}
</code></pre>
Enable CORS with attributes
you have tow option
<ul>
<li>[EnableCors] specifies the default policy.</li>
<li>[EnableCors(&quot;{Policy String}&quot;)] specifies a named policy.</li>
</ul>

blocks|key|2691414|text|在我设法在最琐碎的CORS问题上浪费了两个小时之后，以下是一些故障排除技巧：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2691415|2691416|如果您看到CORS+policy+execution+failed已记录...不要假设您的CORS策略没有正确执行。实际上，CORS中间件工作正常，并且您的策略正在正确执行。这条措辞糟糕的消息唯一的含义是请求的来源与任何允许的来源(see+source)都不匹配，即该请求是不允许的。|ordered-list-item|offset|length|style|CODE|2691417|2691418|2691419|源检查(从ASP.NET+Core5.0开始)以一种非常简单的方式进行...即，在通过HttpContext.Request.Headers[Origin].|2691420|提供的字符串和WithOrigins()中存在的字符串之间进行区分大小写的顺序字符串比较(see+source|2691421|如果您使用尾随斜杠/设置允许的原点，或者如果它包含大写字母，则|2691422|CORS可能会失败。(在我的例子中，实际上我确实意外地复制了带有尾随斜杠的主机。)|2691423|2691424|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/dotnet/aspnetcore/blob/461c4ece84ef5e7385249994645a3262717d3ca5/src/Middleware/CORS/src/Infrastructure/CorsService.cs#L261|1|https://github.com/dotnet/aspnetcore/blob/461c4ece84ef5e7385249994645a3262717d3ca5/src/Middleware/CORS/src/Infrastructure/CorsPolicy.cs#L179^0|0|0|5|S|38|A|0|0|0|0|17|Z|0|7|D|19|A|1|0|9|1|0|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|15|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|16|8|@$F|17|G|18|H|I]]|9|@$F|19|G|1A|1|1B]]|A|$]]|$1|J|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|1D|8|@]|9|@]|A|$]]|$1|L|3|M|5|E|7|1E|8|@$F|1F|G|1G|H|I]]|9|@]|A|$]]|$1|N|3|O|5|6|7|1H|8|@$F|1I|G|1J|H|I]]|9|@$F|1K|G|1L|1|1M]]|A|$]]|$1|P|3|Q|5|6|7|1N|8|@$F|1O|G|1P|H|I]]|9|@]|A|$]]|$1|R|3|S|5|E|7|1Q|8|@]|9|@]|A|$]]|$1|T|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]|$1|U|3|-4|5|6|7|1S|8|@]|9|@]|A|$]]]|V|$W|$5|X|Y|Z|A|$10|11]]|12|$5|X|Y|Z|A|$10|13]]]]

Some troubleshooting tips, after I managed to waste two hours on the most trivial CORS issue:
<ol>
<li>If you see <code>CORS policy execution failed</code> logged... Don't assume that your CORS policy is not executing properly. In fact, the CORS middleware works, and your policy is executing properly. The only thing this badly worded message means is that the request's origin doesn't match any of the allowed origins (<a href="https://github.com/dotnet/aspnetcore/blob/461c4ece84ef5e7385249994645a3262717d3ca5/src/Middleware/CORS/src/Infrastructure/CorsService.cs#L261" rel="nofollow noreferrer">see source</a>), i.e. the request is disallowed.
</li>
<li>The origin check (as of ASP.NET Core 5.0) happens in a very simple way... i.e. case-sensitive ordinal string comparison (<a href="https://github.com/dotnet/aspnetcore/blob/461c4ece84ef5e7385249994645a3262717d3ca5/src/Middleware/CORS/src/Infrastructure/CorsPolicy.cs#L179" rel="nofollow noreferrer">see source</a>) between the strings you provided via <code>WithOrigins()</code> and what exists in <code>HttpContext.Request.Headers[Origin]</code>.
</li>
<li>CORS can fail if you set an allowed origin with a trailing slash <code>/</code>, or if it contains uppercase letters. (In my case I did in fact accidentally copy the host with a trailing slash.)
</li>
</ol>

blocks|key|2903531|text|这涵盖了每个端点。如果要阻止某些端点，请使用此注释DisableCors|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2903532|它在这里描述得很好。|2903533|https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0|offset|length|2903534|如果您使用的是上述配置方法中的app.usecors(policyName)，请在app.authentication()和app.routing()之间添加app.usecors(policyName)。|style|CODE|2903535|2903536|Inside+configureService+Method|ordered-list-item|2903537|2903538|services.AddCors(options+=>+options.AddPolicy(name:+mypolicy,+++++builder+=>+++++{+builder.AllowAnyHeader().AllowAnyMethod().AllowAnyOrigin();+}));|code-block|syntax|javascript|2903539|在每个控制器中添加[EnableCors("mypolicy")]的|2903540|2903541|2903542|++++++++[EnableCors("mypolicy")]+
++++++++[Route("api/[controller]")]+[ApiController]+
++++++++public+class+MyController+:+ControllerBase|2903543|例如：-|2903544|++namespace+CompanyApi2
++++++++{
++++++++++++public+class+Startup
++++++++++++{
++++++++++++++++public+Startup(IConfiguration+configuration)
++++++++++++++++{
++++++++++++++++++++Configuration+=+configuration;
++++++++++++++++}
++++++++
++++++++++++++++public+IConfiguration+Configuration+{+get;+}
++++++++
++++++++++++++++//+This+method+gets+called+by+the+runtime.+Use+this+//method+to+add+services+to+the+container.
++++++++++++++++public+void+ConfigureServices(IServiceCollection+services)
++++++++++++++++{
++++++++++++++++++++services.AddCors(options+=>
++++++++++++++++++++++++options.AddPolicy(name:+mypolicy,
++++++++++++++++++++++++++++builder+=>
++++++++++++++++++++++++++++{
++++++++++++++++++++++++++++++++builder.AllowAnyHeader().AllowAnyMethod()
++++++++++++++++++++++++++++++++++++.AllowAnyOrigin();
++++++++++++++++++++++++++++}));+//add+this
++++++++++++++++++++services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
++++++++++++++++++++services.AddScoped<IDatarepository,+DatabaseRepository>();
++++++++++++++++}
++++++++
++++++++++++++++public+string+mypolicy+=+"mypolicy";
++++++++
++++++++++++++++//+This+method+gets+called+by+the+runtime.+Use+this+method+to+configure+the+HTTP+request+pipeline.
++++++++++++++++public+void+Configure(IApplicationBuilder+app,+IHostingEnvironment+env)
++++++++++++++++{
++++++++++++++++++++if+(env.IsDevelopment())
++++++++++++++++++++{
++++++++++++++++++++++++app.UseDeveloperExceptionPage();
++++++++++++++++++++}
++++++++++++++++++++else
++++++++++++++++++++{
++++++++++++++++++++++++app.UseHsts();
++++++++++++++++++++}
++++++++
++++++++++++++++++++app.UseCors(mypolicy);+//add+this
++++++++++++++++++++app.UseHttpsRedirection();
++++++++++++++++++++app.UseMvc();
++++++++++++++++}
++++++++++++}
++++++++}|2903545|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|26|0|0|F|N|15|K|1Q|D|27|N|0|0|0|0|0|9|O|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1D|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|1E|8|@]|9|@$F|1F|G|1G|1|1H]]|A|$]]|$1|H|3|I|5|6|7|1I|8|@$F|1J|G|1K|J|K]|$F|1L|G|1M|J|K]|$F|1N|G|1O|J|K]|$F|1P|G|1Q|J|K]]|9|@]|A|$]]|$1|L|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]|$1|M|3|N|5|O|7|1S|8|@]|9|@]|A|$]]|$1|P|3|-4|5|6|7|1T|8|@]|9|@]|A|$]]|$1|Q|3|R|5|S|7|1U|8|@]|9|@]|A|$T|U]]|$1|V|3|W|5|6|7|1V|8|@$F|1W|G|1X|J|K]]|9|@]|A|$]]|$1|X|3|-4|5|O|7|1Y|8|@]|9|@]|A|$]]|$1|Y|3|-4|5|6|7|1Z|8|@]|9|@]|A|$]]|$1|Z|3|10|5|S|7|20|8|@]|9|@]|A|$T|U]]|$1|11|3|12|5|6|7|21|8|@]|9|@]|A|$]]|$1|13|3|14|5|S|7|22|8|@]|9|@]|A|$T|U]]|$1|15|3|-4|5|6|7|23|8|@]|9|@]|A|$]]]|16|$17|$5|18|19|1A|A|$1B|E]]]]

This Cover each endpoint . if you want block some endpoint use this annotation [DisableCors] 
it well described here.
 <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0</a>
<ol>
<li>Add <code>app.usecors(policyName)</code> Between <code>app.authentication()</code> and <code>app.routing()</code> If you are using <code>app.usMvc()</code> above it.Inside the Configure Method.
</li>
<li>Inside the configureService Method
</li>
</ol>
<pre><code>services.AddCors(options =&gt; options.AddPolicy(name: mypolicy, builder =&gt; { builder.AllowAnyHeader().AllowAnyMethod().AllowAnyOrigin(); }));
</code></pre>
<ol start="3">
<li>In Each controller add <code>[EnableCors(&quot;mypolicy&quot;)]</code></li>
</ol>
<pre><code> [EnableCors(&quot;mypolicy&quot;)] 
 [Route(&quot;api/[controller]&quot;)] [ApiController] 
 public class MyController : ControllerBase


</code></pre>
eg:-
<pre><code> namespace CompanyApi2
 {
 public class Startup
 {
 public Startup(IConfiguration configuration)
 {
 Configuration = configuration;
 }
 
 public IConfiguration Configuration { get; }
 
 // This method gets called by the runtime. Use this //method to add services to the container.
 public void ConfigureServices(IServiceCollection services)
 {
 services.AddCors(options =&gt;
 options.AddPolicy(name: mypolicy,
 builder =&gt;
 {
 builder.AllowAnyHeader().AllowAnyMethod()
 .AllowAnyOrigin();
 })); //add this
 services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
 services.AddScoped&lt;IDatarepository, DatabaseRepository&gt;();
 }
 
 public string mypolicy = &quot;mypolicy&quot;;
 
 // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
 {
 if (env.IsDevelopment())
 {
 app.UseDeveloperExceptionPage();
 }
 else
 {
 app.UseHsts();
 }
 
 app.UseCors(mypolicy); //add this
 app.UseHttpsRedirection();
 app.UseMvc();
 }
 }
 }
</code></pre>

blocks|key|128243|text|最近在azure+web应用上托管web应用服务器时，不得不编辑azure应用cors设置来解决问题(仅代码不能解决问题)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|128244|128245|+secured+-+Enable+Access-Control-+allow+-Credentials+-leave空白并添加*作为允许的源|ordered-list-item|128246|标记Enable+Access-Control-Allow-Credentials，然后添加您希望允许来自|128247|的请求的域|128248|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|M|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|N|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

Lately when hosting the web app server on azure web app, had to edit azure app cors settings to resolve the matter (code only did not solve the issue)
<ol>
<li>Less secured - Enable Access-Control-Allow-Credentials -leave it blank and add * as an allowed origin</li>
<li>Mark Enable Access-Control-Allow-Credentials and then add the domains you want to allow the requests from</li>
</ol>

blocks|key|129248|text|在.Net+Core+3.1中实现此功能，如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|129249|在ConfigureServices()方法中：|offset|length|style|CODE|129250|+public+void+ConfigureServices(IServiceCollection+services)
++{
+++...
+++services.AddCors();
+++...
++}|code-block|syntax|javascript|129251|在Configure()方法中：|129252|+public+void+Configure(IApplicationBuilder+app,+IWebHostEnvironment+env)
++{
+++...
+++app.UseCors(builder+=>
++++++++++builder.AllowAnyOrigin()
++++++++++.AllowAnyHeader()
++++++++++.AllowAnyMethod()
++++++++);
+++...
++}|129253|entityMap^0|0|1|J|0|0|1|B|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@$D|U|E|V|F|G]]|9|@]|A|$]]|$1|H|3|I|5|J|7|W|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|X|8|@$D|Y|E|Z|F|G]]|9|@]|A|$]]|$1|O|3|P|5|J|7|10|8|@]|9|@]|A|$K|L]]|$1|Q|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|R|$]]

Got this working with .Net Core 3.1 as follows:
In <code>ConfigureServices()</code> method:
<pre><code> public void ConfigureServices(IServiceCollection services)
 {
 ...
 services.AddCors();
 ...
 }
</code></pre>
In <code>Configure()</code> method:
<pre><code> public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 {
 ...
 app.UseCors(builder =&gt;
 builder.AllowAnyOrigin()
 .AllowAnyHeader()
 .AllowAnyMethod()
 );
 ...
 }
</code></pre>

blocks|key|130745|text|安装nuget包Microsoft.AspNetCore.CORS|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|130746|在ConfigureServices方法下的Startup.cs中，在services.AddMVC()之前添加以下代码|130747|services.AddCors(options+=>
{
++++options.AddPolicy("AllowMyOrigin",+p+=>
++++{
++++++++p.AllowAnyOrigin()
++++++++++++.AllowAnyHeader()
++++++++++++.AllowAnyMethod();
++++});
});|code-block|syntax|javascript|130748|在Configure方法内部的Startup.cs中，在调用app.UseMvc()之前添加app.UseCors("AllowMyOrigin");|130749|请注意，当从客户端发送请求时，请记住使用https而不是http。|130750|entityMap^0|8|P|0|1|H|M|A|Z|H|0|0|1|9|F|A|U|C|1A|T|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|V|8|@$9|W|A|X|B|C]|$9|Y|A|Z|B|C]|$9|10|A|11|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|12|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|13|8|@$9|14|A|15|B|C]|$9|16|A|17|B|C]|$9|18|A|19|B|C]|$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|O|3|P|5|6|7|1C|8|@]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|1D|8|@]|D|@]|E|$]]]|R|$]]

Install nuget package <code>Microsoft.AspNetCore.CORS</code>
In <code>Startup.cs</code> under <code>ConfigureServices</code> method add the following code before <code>services.AddMVC()</code>
<pre><code>services.AddCors(options =&gt;
{
 options.AddPolicy(&quot;AllowMyOrigin&quot;, p =&gt;
 {
 p.AllowAnyOrigin()
 .AllowAnyHeader()
 .AllowAnyMethod();
 });
});
</code></pre>
In <code>Startup.cs</code> inside the <code>Configure</code> method add <code>app.UseCors(&quot;AllowMyOrigin&quot;);</code> before you call <code>app.UseMvc()</code>
Note that when sending a request from client side remember to use https instead of http.

blocks|key|131377|text|对于.Net+CORE+3.1，请使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|131378|app.UseCors(x+=>+x.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader())|code-block|syntax|javascript|131379|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

for .Net CORE 3.1 use:
<pre><code>app.UseCors(x =&gt; x.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader())
</code></pre>

blocks|key|131381|text|请注意，结尾的"/“将阻止CORS来源|type|unstyled|depth|inlineStyleRanges|entityRanges|data|131382|builder.WithOrigins("http://example.com/","http://localhost:55233/");|code-block|syntax|javascript|131383|将阻止|131384|使用|131385|builder.WithOrigins("http://example.com","http://localhost:55233");+|131386|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|D|7|S|8|@]|9|@]|A|$E|F]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

pay attantion that &quot;/&quot; in the end - will block the CORS origin
<pre><code>builder.WithOrigins(&quot;http://example.com/&quot;,&quot;http://localhost:55233/&quot;);
</code></pre>
will block
use
<pre><code>builder.WithOrigins(&quot;http://example.com&quot;,&quot;http://localhost:55233&quot;); 
</code></pre>

I am trying to enable cross origin resources sharing on my ASP.NET Core Web API, but I am stuck.
The <code>EnableCors</code> attribute accepts <code>policyName</code> of type <code>string</code> as parameter:
<pre class="lang-cs prettyprint-override"><code>// Summary:
// Creates a new instance of the Microsoft.AspNetCore.Cors.Core.EnableCorsAttribute.
//
// Parameters:
// policyName:
// The name of the policy to be applied.
public EnableCorsAttribute(string policyName);

</code></pre>
What does the <code>policyName</code> mean and how can I configure CORS on an ASP.NET Core Web API?

How to enable CORS in ASP.NET Core

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我尝试在我的ASP.NET Core Web API上启用跨域资源共享，但我卡住了。EnableCors属性接受string类型的policyName作为参数：// Summary://     Creates a new instance of the Microsoft.AspNetCore.Cors.Core.E...

问如何在ASP.NET核心中启用CORS
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在ASP.NET核心中启用CORSEN