title: Unexpected behavior with CORS on .NET Core
body: <p>I have added the following to my service configuration.</p>
  <pre><code>services.AddCors(options 
      =&gt; options.AddDefaultPolicy(builder 
          =&gt; builder
              //.AllowAnyHeader()
              .WithHeaders(&quot;header-that-nobody-knows&quot;)
              .WithOrigins(&quot;http://localhost:44304&quot;)));
  </code></pre>
  <p>My expectation was that the calls would bounce (as I don't add <em>header-that-nobody-knows</em> to my headers). However, the request is carried out just as if <code>AllowAnyHeader()</code> was set.</p>
  <p>Manipulating the port, domain or protocol in <code>WithOrigins()</code> produces the expected result, so the config seems to be wired up properly. I suspect it's a special case somehow because I'm getting unexpected behavior with <code>WithMetod()</code> when it comes to <em>GET</em> and <em>POST</em> (while other methods are blocked/allowed depending on the paramers passed).</p>
  <p>Checking <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0" rel="nofollow noreferrer">MSDN</a> gave nothing I recon as explanation.</p>
  <p>I doubt that it matters but for completeness sake, here's the Angular code invoking the call.</p>
  <pre><code>let url = &quot;https://localhost:44301/security/corstest?input=blobb&quot;;
  this.http.get&lt;any&gt;(url).subscribe(
    next =&gt; console.log(&quot;next&quot;, next),
    err =&gt; console.warn(&quot;err&quot;, err));
  </code></pre>
  <p>The action method looks as below.</p>
  <pre><code>[HttpGet(&quot;corstest&quot;)]
  public IActionResult CorsTest([FromQuery] string input)
  {
      return Ok(new { data = input + &quot; indeed...&quot; });
  }
  </code></pre>