In this blog post, we will explain what CORS is and how to enable and implement it effectively in ASP.NET Web API.

What is CORS?

CORS stands for Cross-Origin Resource Sharing, which is a mechanism that allows web browsers to request and receive resources from different origins or domains. An origin is defined by the scheme (http or https), the host (domain name or IP address), and the port of a URL. For example, https://example.com:443 and http://example.com:80 are different origins.

By default, web browsers follow the same-origin policy, which means they only allow requests and responses within the same origin. This policy prevents malicious websites from accessing sensitive data or resources from other websites. However, this policy also limits the functionality and interoperability of web applications that need to communicate with different origins.

CORS enables web applications to overcome the same-origin policy by allowing web servers to specify which origins are allowed to access their resources and under what conditions. For example, a web server can allow a web application from https://foo.com to access its resources, but only with GET requests and without cookies.

How to enable and implement CORS in ASP.NET Web API?

To enable and implement CORS in ASP.NET Web API, you need to follow these steps:

• Install the Microsoft.AspNetCore.Cors NuGet package in your project. This package provides the middleware and services for CORS support in ASP.NET Web API.

• Add the CORS service to the dependency injection container in your Program.cs file. You can use the AddCors method to configure the CORS policy for your web service. A CORS policy defines which origins are allowed to access your resources, which HTTP methods are allowed, which HTTP headers are allowed, whether credentials are allowed, and how long the browser can cache the preflight response. For example:

// Add services to the container.
builder.Services.AddCors(options =>
{
    // Define a default CORS policy
    options.AddDefaultPolicy(builder =>
    {
        // Allow any origin
        builder.AllowAnyOrigin()
            // Allow GET and POST methods
            .WithMethods("GET", "POST")
            // Allow Content-Type header
            .WithHeaders("Content-Type");
    });
});

• Add the CORS middleware to the request pipeline in your Program.cs file. You can use the UseCors method to apply the CORS policy to your web service. You need to add the CORS middleware before any other middleware that handles requests or responses. For example:

// Configure the HTTP request pipeline.
app.UseCors(); // Apply the default CORS policy
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseAuthorization();
app.MapControllers();
app.Run();

• Optionally, you can also use attributes to apply CORS policies at the controller or action level. You can use the [EnableCors] attribute to specify a named policy or a custom policy for a controller or an action. You can use the [DisableCors] attribute to disable CORS for a controller or an action. For example:

// Define a named CORS policy
builder.Services.AddCors(options =>
{
    options.AddPolicy("CustomPolicy", builder =>
    {
        builder.WithOrigins("https://foo.com", "https://bar.com")
            .WithMethods("GET")
            .AllowCredentials();
    });
});

// Apply the named policy to a controller
[EnableCors("CustomPolicy")]
[Route("api/[controller]")]
[ApiController]
public class ValuesController : ControllerBase
{
    // Apply a custom policy to an action
    [EnableCors(policyBuilder => policyBuilder.WithOrigins("https://baz.com").AllowAnyMethod())]
    [HttpGet]
    public IEnumerable<string> Get()
    {
        return new string[] { "value1", "value2" };
    }

    // Disable CORS for an action
    [DisableCors]
    [HttpPost]
    public void Post([FromBody] string value)
    {
        // Do something
    }
}

Hope this helped you get to know about ASP.NET Web API - Enabling and implementing CORS effectively.