title: How to enable CORS globally in ASP.NET web API core
body: <p>I found this site:</p>
  
  <p><a href="https://docs.microsoft.com/en-us/aspnet/core/security/cors" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/cors</a></p>
  
  <p>However I am confused in how to enable it globally, because it seems there are 2 ways to do it, whats the difference between these 2 ways? or they do 2 different things?</p>
  
  <pre><code>public IConfigurationRoot Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              //https://docs.microsoft.com/en-us/aspnet/core/security/cors
              services.AddCors(options =&gt;
              {
                  options.AddPolicy("AllowSpecificOrigin",
                      builder =&gt; builder.WithOrigins("http://example.com")
                                          .AllowAnyHeader()
                      );
              });
  
              services.Configure&lt;MvcOptions&gt;(options =&gt;
              {
                  options.Filters.Add(new CorsAuthorizationFilterFactory("AllowSpecificOrigin"));
              });
  
              // Add framework services.
              services.AddMvc();
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
          {
              loggerFactory.AddConsole(Configuration.GetSection("Logging"));
              loggerFactory.AddDebug();
  
              app.UseCors("AllowSpecificOrigin");
  
              app.UseMvc();
          }
  </code></pre>