.NET 8's Cross-Origin Resource Sharing (CORS)

Web browsers use a security mechanism called Cross-Origin Resource Sharing (CORS) to limit what resources can be requested from other domains. You can easily manage which domains can access your resources and APIs with.NET 8's CORS management feature.

CORS: What is it?
Web browsers use a security feature called Cross-Origin Resource Sharing, or CORS, to stop pages from requesting resources from a domain other than the one that served them. Put more simply, CORS is a mechanism to permit or deny requests for resources from another domain on a webpage.

Understanding CORS

Same-Origin Policy (SOP): Web browsers enforce the Same-Origin Policy to enhance security. This policy ensures that a web page can only make requests to the same origin (domain, protocol, and port) that served the web page. For example, a web page served from https://example.com cannot request https://anotherdomain.com under the SOP.
CORS: To enable requests to different domains, CORS relaxes the Same-Origin Policy under specific conditions. It allows a server to indicate which origins (domains) are permitted to access its resources.

Why is CORS Needed?

CORS is essential when your web application interacts with resources from a different domain. It allows servers to specify who can access the assets and how the requests should be handled, thus relaxing the same-origin policy in a controlled way.

How CORS Works?
Preflight Request

For certain types of requests (e.g., requests with methods like PUT or DELETE or requests that include custom headers), the browser sends a preliminary request called a "preflight" request. This is an OPTIONS request sent to the server to check if the actual request is safe to send.

Blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

CORS Headers

The server responds to the preflight request (and to the actual request) with special headers.

Access-Control-Allow-Origin: Specifies which origin(s) are allowed to access the resource. It can be a specific origin (e.g., https://example.com) or a wildcard (*) to allow any origin.
Access-Control-Allow-Methods: Lists the HTTP methods (e.g., GET, POST, PUT) that are allowed when accessing the resource.
Access-Control-Allow-Headers: Lists the headers that are allowed in the actual request.
Access-Control-Allow-Credentials: Indicates whether the response to the request can be exposed when the credentials flag is true.

When you are building an application that serves resources (like APIs), and your front end is hosted on a different domain, you might encounter CORS issues. The browser will, by default, block requests from the front end to the backend if they are from different origins.

Setting Up CORS in .NET 8
Creating a New ASP.NET Core Project
I'm using Visual Studio 2022, going to create a new project as a Core-Config and Solution as a Web_ Solution.

Open your Visual Studio, Click on Create a new project, select ASP.NET Core Web API, and click on the Next button.

Now click on the Create Button.

// Add services to the container.
#region Configure CORS
builder.Services.AddCors(options =>
{
    options.AddPolicy("CustomPolicy", builder =>
        builder.WithOrigins()
               .AllowAnyMethod()
               .AllowAnyHeader());
});
#endregion

Code explanation.

builder.Services.AddCors(options =>{...});

This line is adding CORS services to the application's service collection. The AddCors method takes a lambda expression to configure CORS options.

options.AddPolicy("CustomPolicy",builder => {...});

The AddPolicy method defines a new CORS policy named "CustomPolicy" within the lambda expression.

The AddPolicy method takes two parameters: the name of the policy and a lambda expression to configure the policy.

builder => builder.WithOrigins()

This part of the lambda expression is configuring the CORS policy. The builder object is used to specify the details of the policy.

WithOrigins("https://example.com") specifies that only requests from the origin https://example.com are allowed.

.AllowAnyMethod()

This method allows any HTTP method (GET, POST, PUT, DELETE, etc.) in the requests from the specified origin.

.AllowAnyHeader()

This method allows any headers in the requests from the specified origin.

Using CORS Middleware

To apply the CORS policy, add the middleware to the HTTP request pipeline.

app.UseCors("CustomPolicy");

You can see the Program.cs file.

var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
#region Configure CORS
builder.Services.AddCors(options =>
{
    options.AddPolicy("CustomPolicy", builder =>
        builder.WithOrigins()
               .AllowAnyMethod()
               .AllowAnyHeader());
});
#endregion
builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
var app = builder.Build();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}
// Add Middleware
// --------------------------
// Using CORS Middleware
app.UseCors("CustomPolicy");
app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();
app.Run();

Advanced CORS Configuration
Allowing All Origins

For development purposes, you should allow all origins. Be cautious with this in production.

// Add services to the container.
#region Configure CORS

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowAllOriginsPolicy",
        builder => builder.AllowAnyOrigin()
                          .AllowAnyMethod()
                          .AllowAnyHeader());
});
#endregion

Allowing Multiple Origins

You can specify multiple origins by listing them in the WithOrigins method.

// Add services to the container.
#region Configure CORS
builder.Services.AddCors(options =>
{
    options.AddPolicy("CustomAllowOriginsPolicy",
        builder => builder.WithOrigins("https://abc-example1.com", "https://abc-example2.com")
                          .AllowAnyMethod()
                          .AllowAnyHeader());
});
#endregion

Handling Preflight Requests

Preflight requests are made by browsers to determine if the actual request is safe to send. Ensure you handle them correctly.

// Add services to the container.
#region Configure CORS
builder.Services.AddCors(options =>
{
    options.AddPolicy("HandlePreflight",
        builder => builder.WithOrigins("https://abc-example.com")
                          .AllowAnyMethod()
                          .AllowAnyHeader()
                          .SetPreflightMaxAge(TimeSpan.FromMinutes(10)));
});


#endregion

Applying CORS to Specific Controllers
Using Attributes

You can apply CORS policies to specific controllers or actions using attributes.

[ApiController]
[Route("api/[controller]")]
[EnableCors("CustomAllowOriginsPolicy")]
public class TestController : ControllerBase
{
    [HttpGet]
    public IActionResult Get()
    {
        return Ok("CORS is enabled for this endpoint.");
    }
}

Testing CORS Configuration
Using Browser Developer Tools

Use the browser's developer tools to inspect CORS requests and responses. Look for the Access-Control-Allow-Origin header in the response to verify that CORS is configured correctly.

Common Issues and Troubleshooting

CORS Errors

No 'Access-Control-Allow-Origin' Header: Ensure the CORS policy is correctly applied and the origin is allowed.
Preflight Request Fails: Check the server's response to the preflight request and ensure the necessary headers are included.

Debugging Tips

Check the server logs for errors.
Use network tracing tools to inspect HTTP requests and responses.

ASP.NET Core 9.0 Hosting Recommendation

One of the most important things when choosing a good ASP.NET Core 9.0 hosting is the feature and reliability. HostForLIFE is the leading provider of Windows hosting and affordable ASP.NET Core, their servers are optimized for PHP web applications. The performance and the uptime of the hosting service are excellent and the features of the web hosting plan are even greater than what many hosting providers ask you to pay for.

At HostForLIFE.eu, customers can also experience fast ASP.NET Core hosting. The company invested a lot of money to ensure the best and fastest performance of the datacenters, servers, network and other facilities. Its datacenters are equipped with the top equipments like cooling system, fire detection, high speed Internet connection, and so on. That is why HostForLIFEASP.NET guarantees 99.9% uptime for ASP.NET Core. And the engineers do regular maintenance and monitoring works to assure its Orchard hosting are security and always up.