Configure CORS

Configuring Cross-Origin Resource Sharing (CORS) is only required if the API is being called from a browser app hosted on a different domain. For example, if your single-page JavaScript app is on example.com, but your API is hosted on api.example.com, you need to enable CORS.

• ASP.NET
• ASP.NET Core 2.x
• ASP.NET Core 3.x
• Go
• Node Express
• PHP
• Spring Boot

Install the following dependencies in your project:

• Microsoft.AspNetCore.Cors

Open the Startup.cs file and update the ConfigureServices method to enable CORS:

public void ConfigureServices(IServiceCollection services)
{
    //...
    services.AddCors(options =>
    {
        // The CORS policy is open for testing purposes. In a production application, you should restrict it to known origins.
        options.AddPolicy(
            "AllowAll",
            builder => builder.AllowAnyOrigin()
                              .AllowAnyMethod()
                              .AllowAnyHeader());
    });
}

Then, you need to enable cross-origin requests. Add the EnableCors attribute with the AllowAll policy to your Web API controller or controller method:

public class MessagesController : Controller
{
    [HttpGet]
    [Route("~/api/messages")]
    [EnableCors("AllowAll")]
    public JsonResult Get()
    {
        return Json(new
        {
            messages = new dynamic[]
            {
                new { Date = DateTime.Now, Text = "I am a Robot." },
                new { Date = DateTime.Now, Text = "Hello, world!" },
            },
        });
    }
}

Update your using statements to import Microsoft.AspNetCore.Cors:

using Microsoft.AspNetCore.Cors;

Next Steps