title: aspnetcore 2.2 api CORS policy
body: <p>I've updated netcoreapp to 2.2 from 2.1 and cannot figure how to make CORS work again. Previously used following configuration:</p>
  
  <pre><code>            services.AddCors(o =&gt; o.AddPolicy("App", builder =&gt;
              builder
                  .AllowAnyOrigin()
                  .AllowAnyMethod()
                  .AllowAnyHeader()
                  .AllowCredentials()
  </code></pre>
  
  <p>After upgrading to 2.2 <code>.AllowAnyOrigin()</code> is no longer supported. I've changed configuration to:</p>
  
  <pre><code>        services.AddCors(o =&gt; o.AddPolicy("App", builder =&gt;
              builder
                  .WithOrigins("http://localhost:8080", "ionic://localhost", "http://localhost") // (development, cordova-ios, cordova-android)
                  .AllowAnyMethod()
                  .AllowAnyHeader()
                  .AllowCredentials()
          ));
      }
  </code></pre>
  
  <p>Also I am using <a href="https://github.com/ionic-team/cordova-plugin-ionic-webview" rel="nofollow noreferrer">https://github.com/ionic-team/cordova-plugin-ionic-webview</a> plugin for cordova. Webview origin for android and ios are as following: <a href="http://localhost" rel="nofollow noreferrer">http://localhost</a>, ionic://localhost</p>
  
  <p>I am receiving following error on Android:</p>
  
  <pre><code>Access to XMLHttpRequest at 'https://my-host-app.azurewebsites.net/api/user/profile' from origin 'http://localhost' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested 
  </code></pre>
  
  <p>Request Headers:</p>
  
  <pre><code>:authority: my-host-app.azurewebsites.net
  :method: OPTIONS
  :path: /api/user/profile
  :scheme: https
  accept: */*
  accept-encoding: gzip, deflate
  accept-language: en-US,ru-RU;q=0.9
  access-control-request-headers: api-version,deviceid,isapp
  access-control-request-method: GET
  origin: http://localhost
  referer: http://localhost/
  user-agent: Mozilla/5.0 (Linux; Android 8.0.0; ONEPLUS A3003 Build/OPR1.170623.032; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.99 Mobile Safari/537.36
  x-requested-with: com.company.my-app
  </code></pre>
  
  <p>Response Headers:</p>
  
  <pre><code>access-control-allow-credentials: true
  access-control-allow-headers: api-version,deviceid,isapp
  access-control-allow-methods: GET
  access-control-allow-origin: http://localhost
  date: Tue, 08 Jan 2019 11:52:54 GMT
  request-context: appId=cid-v1:d20ad272-fa9b-4051-a89a-eea17ae49380
  server: Kestrel
  set-cookie: ARRAffinity=2252b451f5ef07b7d0d5027457bd2b71e73fb479db2cf5924161a51c2ec7b5;Path=/;HttpOnly;Domain=my-host-app.azurewebsites.net
  status: 204
  strict-transport-security: max-age=2592000
  vary: Origin
  x-powered-by: ASP.NET
  </code></pre>
  
  <p>Same on iPhone but with ionic://localhost.</p>