title: Enable CORS is not working after publishing into IIS
body: <p>I hosted dotnet core 2.2 web api application to local IIS. When i run hosted site, site is working. I am trying to do login from angular, it is not working.</p>
  <p>It says <strong>Access to XMLHttpRequest at 'http://192.168.43.143:100/Auth/Login' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.</strong></p>
  <p><strong>Note</strong>: It was working locally. No CORS policy issue occured</p>
  <p>I have added cors policy in ConfigureServices and provide middleware to add UseCors().</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
     services.AddCors(c =&gt;  
              {    
                  c.AddPolicy(&quot;AllowOrigin&quot;, options =&gt; options.AllowAnyHeader()
                      .AllowAnyMethod().AllowAnyOrigin()
                      .SetIsOriginAllowed((host) =&gt; true).AllowCredentials());  
              });
  
     services.Configure&lt;MvcOptions&gt;(options =&gt; {
                  options.Filters.Add(new CorsAuthorizationFilterFactory(&quot;AllowOrigin&quot;));
              });
  }
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
      app.UseCors(&quot;AllowOrigin&quot;);
      app.UseMvc();
  }
  </code></pre>
  <p>My installed software details are given below,</p>
  <ul>
  <li>System:  Windows 10</li>
  <li>DotNet Core SDK: 2.2.110 &amp; 3.1.201</li>
  <li>Windows Server Hosting: 2.2.1</li>
  </ul>
  <p>Basic code is given below for your reference.</p>
  <p>Dot Net Core Web API:</p>
  <p>Program.cs</p>
  <pre><code>public class Program
      {
          public static void Main(string[] args)
          {
              CreateWebHostBuilder(args).Build().Run();
          }
  
          public static IWebHostBuilder CreateWebHostBuilder(string[] args) =&gt;
              WebHost.CreateDefaultBuilder(args)
                  .UseUrls(&quot;http://localhost:4000&quot;)
                  .UseStartup&lt;Startup&gt;();
      }
  </code></pre>
  <p>StartUp.cs</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
  
              services.AddCors(c =&gt;
              {
                  c.AddPolicy(&quot;AllowOrigin&quot;,
                      options =&gt; options.WithOrigins(&quot;*&quot;).AllowCredentials().AllowAnyHeader().AllowAnyMethod()
                  );
              });
  
              // DbContext and JWT implementation done
  
              // Authorization filter added
              
              services.Configure&lt;MvcOptions&gt;(options =&gt; {
                  options.Filters.Add(new CorsAuthorizationFilterFactory(&quot;AllowOrigin&quot;));
              });
  
              //Dependence Injunction done
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              // app.UseForwardedHeaders();
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                  app.UseHsts();
              }
  
              app.UseAuthentication();  //it is used to authorize jwt tokens
              app.UseDefaultFiles();
              app.UseStaticFiles();
              app.UseHttpsRedirection();
              app.UseCors();
              app.UseMvc();
          }
  </code></pre>
  <p>Hosted Web.config:</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
  &lt;configuration&gt;
    &lt;location path=&quot;.&quot; inheritInChildApplications=&quot;false&quot;&gt;
      &lt;system.webServer&gt;
        &lt;handlers&gt;
          &lt;add name=&quot;aspNetCore&quot; path=&quot;*&quot; verb=&quot;*&quot; modules=&quot;AspNetCoreModuleV2&quot; resourceType=&quot;Unspecified&quot; /&gt;
        &lt;/handlers&gt;
        &lt;aspNetCore processPath=&quot;dotnet&quot; arguments=&quot;.\TestAPI.dll&quot; stdoutLogEnabled=&quot;false&quot; stdoutLogFile=&quot;.\logs\stdout&quot; hostingModel=&quot;InProcess&quot; /&gt;
      &lt;/system.webServer&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  &lt;!--ProjectGuid: 9aea96ef-cfc4-4231-9bfb-78f4efec933f--&gt;
  </code></pre>
  <p>launchSettings.json:</p>
  <pre><code>{
    &quot;$schema&quot;: &quot;http://json.schemastore.org/launchsettings.json&quot;,
    &quot;iisSettings&quot;: {
      &quot;windowsAuthentication&quot;: false, 
      &quot;anonymousAuthentication&quot;: true, 
      &quot;iisExpress&quot;: {
        &quot;applicationUrl&quot;: &quot;http://localhost:4000&quot;,
        &quot;sslPort&quot;: 0
      }
    },
    &quot;profiles&quot;: {
      &quot;IIS Express&quot;: {
        &quot;commandName&quot;: &quot;IISExpress&quot;,
        &quot;launchBrowser&quot;: true,
        //&quot;launchUrl&quot;: &quot;api/values&quot;,
        &quot;environmentVariables&quot;: {
          &quot;ASPNETCORE_ENVIRONMENT&quot;: &quot;Development&quot;
        }
      },
      &quot;TestAPI&quot;: {
        &quot;commandName&quot;: &quot;Project&quot;,
        &quot;launchBrowser&quot;: true,
        &quot;launchUrl&quot;: &quot;http://localhost:4000/values&quot;,
        &quot;applicationUrl&quot;: &quot;https://localhost:5001;http://localhost:5000&quot;,
        &quot;environmentVariables&quot;: {
          &quot;ASPNETCORE_ENVIRONMENT&quot;: &quot;Development&quot;
        }
      }
    }
  }
  </code></pre>
  <p>Angular 7:</p>
  <p>Interceptor code is given</p>
  <pre><code>const authReq = this.currentuser
        ? request.clone({
          headers: request.headers.set('Authorization', 'Bearer ' + this.currentuser)
            .set('Access-Control-Allow-Origin', '*')
            .set('Access-Control-Allow-Methods', 'GET, POST, PATCH, PUT, DELETE, OPTIONS')
            .set('Content-Type', request.headers.get('content-type') ?
              request.headers.get('content-type') : 'application/json')
        })
        : request.clone({
          headers: request.headers
          .set('Access-Control-Allow-Origin', '*')
            .set('Access-Control-Allow-Methods', 'GET, POST, PATCH, PUT, DELETE, OPTIONS')
            .set('Content-Type', 'application/json')
        });
      return next.handle(authReq).pipe(
        catchError((error: HttpErrorResponse) =&gt; {
          if (error.status === 401) {
            // auto logout if 401 response returned from api
            this.authenticationService.logout();
            // tslint:disable-next-line: deprecation
            location.reload(true);
          }
          return throwError(error);
        }));
  </code></pre>
  <p>IIS Configuration image given below
  <a href="https://i.stack.imgur.com/YE46W.png" rel="noreferrer"><img src="https://i.stack.imgur.com/YE46W.png" alt="enter image description here" /></a></p>