CodeOath
← All posts
.NET Core / Web API70 min total · 19 parts

Building REST APIs with ASP.NET Core: Routing, Middleware, and Dependency Injection

Contents — Part 13 of 19: CORS
  1. 1.Overview
  2. 2.The Minimal Hosting Model and Program.cs
  3. 3.The Middleware Pipeline
  4. 4.Routing: Attributes Map a URL to a Method
  5. 5.Controllers, [ApiController], and ControllerBase
  6. 6.Model Binding: Where Parameters Come From
  7. 7.Model Validation with Data Annotations
  8. 8.Action Results and Status Codes
  9. 9.Dependency Injection and Service Lifetimes
  10. 10.Configuration and the Options Pattern
  11. 11.Entity Framework Core: DbContext Lifetime and Async Queries
  12. 12.Authentication and Authorization Middleware
  13. 13.CORS
  14. 14.Error Handling and ProblemDetails
  15. 15.Filters: Cross-Cutting Logic Around Actions
  16. 16.API Versioning and Documentation
  17. 17.Async/Await Throughout the Pipeline
  18. 18.Testing Web API Controllers
  19. 19.Common Mistakes Worth Remembering
Part 13 of 19 · ~1 min

CORS

Cross-Origin Resource Sharing controls whether a browser running JavaScript from one origin is allowed to call your API on a different origin — a browser-enforced restriction, not a server-side security boundary by itself (a non-browser client, like curl or a mobile app, isn't affected by CORS at all).

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowFrontend", policy =>
        policy.WithOrigins("https://app.example.com")
              .AllowAnyMethod()
              .AllowAnyHeader()
              .AllowCredentials());
});

// ...

app.UseCors("AllowFrontend"); // must run before UseAuthorization, and before MapControllers

A common mistake is reaching for AllowAnyOrigin() to make a CORS error "go away" during development and shipping it to production — combined with AllowCredentials() specifically, this combination isn't even allowed by the CORS spec (browsers reject a wildcard origin paired with credentials), and more generally it defeats the entire purpose of CORS as a boundary. Register named, explicit policies with a known list of allowed origins for anything beyond local development.

← Previous
Authentication and Authorization Middleware
Next →
Error Handling and ProblemDetails