CORS and how to enable them in .NET Core ?

What is CORS

CORS stands for Cross Origin Resource sharing, so what exactly is cross origin, let’s understand with some dummy URLs.

These two URLs have the same origin

URL No 1 : https://www.facebook.com/GetFriends

URL No 2 : https://www.facebook.com/GetPosts

These URLs have different origins

URL No 1: https://www.facebook.com/GetFriends

URL No 2 :https://www.twitter.com/GetFollowers

Suppose we have an .NET Core Web API which is responsible for data and we have three different applications with different origins that use that API , so here comes the concept of CORS in action. We need to enable the CORS to

• Facilitate requests from different origins
• To get away from browsers same origin policy
• Browsers without CORS can’t do cross-origin requests.

Different available methods

In .NET 6 by using the combination of these methods we can enable CORS as per our need.

𝐀𝐥𝐥𝐨𝐰𝐀𝐧𝐲𝐎𝐫𝐢𝐠𝐢𝐧: This policy allows requests from any origin.

𝐖𝐢𝐭𝐡𝐎𝐫𝐢𝐠𝐢𝐧𝐬: This policy allows requests from specific origins. You can specify one or more origins as arguments to this method.

𝐀𝐥𝐥𝐨𝐰𝐀𝐧𝐲𝐇𝐞𝐚𝐝𝐞𝐫: This policy allows requests with any header.

𝐖𝐢𝐭𝐡𝐇𝐞𝐚𝐝𝐞𝐫𝐬: This policy allows requests with specific headers. You can specify one or more headers as arguments to this method.

𝐀𝐥𝐥𝐨𝐰𝐀𝐧𝐲𝐌𝐞𝐭𝐡𝐨𝐝: This policy allows requests with any HTTP method (e.g., GET, POST, PUT, DELETE).

𝐖𝐢𝐭𝐡𝐌𝐞𝐭𝐡𝐨𝐝𝐬: This policy allows requests with specific HTTP methods. You can specify one or more methods as arguments to this method.

How to enable them with and without restrictions

Following code demonstrates how to enable CORS and allow request from any origin with any header and any method in Program.cs

// Enable CORS, allow any Origin and get policy name from appSettings
var cors = builder.Configuration.GetSection("Cors");
builder.Services.AddCors(options =>
{
    options.AddPolicy(name: cors.GetValue<string>("PolicyName"),
        builder =>
        {
            builder.AllowAnyOrigin();
            builder.AllowAnyHeader();
            builder.AllowAnyMethod();
        });
});

app.UseRouting();
app.UseAuthentication();
// Enable CORS
app.UseCors(cors.GetValue<string>("PolicyName"));
app.UseHttpsRedirection();

We can restrict those requests to few origins as well , following code displays how to allow only Get/Put requests from few origins.

Instead of getting policy name from appsetting we can pass direct string as well like

options.AddPolicy(name : “_AllowAnyOriginPolicy”)

builder.Services.AddCors(options =>
{
    options.AddPolicy(name: cors.GetValue<string>("PolicyName"), builder =>
    {
        builder.WithOrigins("https://hakuna.com",
         "https://hakuna.net",
         "https://hakuna.edu");
        builder.AllowAnyHeader();
        builder.WithMethods("Get", "Put");
    });
});

Important things to keep in mind about CORS

✔️CORS is not a security feature. CORS is a W3C standard that allows a server to relax the same-origin policy.

✔️An API isn’t safer by allowing CORS.