title: NET5.0 Blazor WASM CORS client exception
body: <p>I have a Blazor WASM app and a Web Api to get called by Blzor via HttpClient. Both programs run on the same machine (and also in production environment which should not be to exotic for a small business application!).</p>
  <p>Calling the Web Api from the Blazor client result in a client CORS exception</p>
  <p>Access to fetch at 'http://localhost:4040/' from origin 'https://localhost:5001' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.</p>
  <p>which is the expected behavior for this case.</p>
  <p>In an former api project I developed in PHP, that had the same client behavior, I can bypass the CORS exception by simply setting the response header e.g.</p>
  <pre><code>$response = new Response;
  $response-&gt;setState(false, $route-&gt;command);
  ...
  header(&quot;Access-Control-Allow-Origin: *&quot;);
  echo $response;
  </code></pre>
  <p>Now I want this in my .net 5.0 Web Api. I found different docs in the internet to cope with that like in</p>
  <p><a href="https://docs.microsoft.com/de-de/aspnet/core/security/cors?view=aspnetcore-5.0" rel="noreferrer">https://docs.microsoft.com/de-de/aspnet/core/security/cors?view=aspnetcore-5.0</a>
  <a href="https://www.c-sharpcorner.com/article/enabling-cors-in-asp-net-core-api-application/" rel="noreferrer">https://www.c-sharpcorner.com/article/enabling-cors-in-asp-net-core-api-application/</a>
  <a href="https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.cors.infrastructure.corspolicybuilder.withorigins?view=aspnetcore-5.0" rel="noreferrer">https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.cors.infrastructure.corspolicybuilder.withorigins?view=aspnetcore-5.0</a></p>
  <p>and implemented it in my api</p>
  <pre><code>    public class Startup {
          //---------------------------------------------------------------------
  
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
          //---------------------------------------------------------------------
  
          public IConfiguration Configuration { get; }
  
          //---------------------------------------------------------------------
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices
                      (
                          IServiceCollection services
                      )
                      =&gt;  services
                          .AddCors()
                          .AddSwaggerGen(c =&gt; c.SwaggerDoc(&quot;v1&quot;, new OpenApiInfo { Title = &quot;api&quot;, Version = &quot;v1&quot;}) )
                          .AddControllers()
                          ;
          //---------------------------------------------------------------------
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure
                      (
                          IApplicationBuilder app,
                          IWebHostEnvironment env
                      )
                      =&gt;  app.
                          apply( _ =&gt;
                          {
                              if (true) //(env.IsDevelopment())
                              {
                                  app
                                  .UseDeveloperExceptionPage()
                                  .UseSwagger()
                                  .UseSwaggerUI( c =&gt; c.SwaggerEndpoint(&quot;/swagger/v1/swagger.json&quot;, &quot;api v1&quot;) );
                              }
                          })
                          .UseCors( cors =&gt;
                              cors
                              .AllowAnyHeader()
                              .AllowAnyMethod()
                              .SetIsOriginAllowed( _ =&gt; true )
                              .AllowCredentials()
                          )
                          .UseHttpsRedirection()
                          .UseRouting()
                          .UseAuthorization()
                          .UseEndpoints( e =&gt; e.MapControllers() )
                          ;
          //---------------------------------------------------------------------
      }
  </code></pre>
  <p>Even tried to set the Response Header in the ApiController</p>
  <pre><code>    [Route(&quot;/&quot;)]
      [ApiController]
      public sealed class ServertimeController : ControllerBase
      {
          //[EnableCors(&quot;AllowOrigin&quot;)]
          [HttpGet]
          public Servertime Get() {
  
              Response.Headers.Add(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
              Response.Headers.Add(&quot;Access-Control-Allow-Methods&quot;, &quot;GET, POST, PUT&quot;);
  
              return servertime();
          }
      }
  </code></pre>
  <p>The Blazor WASM client looks like</p>
  <pre><code>    private async void onClick()
      {
  
          var response = await httpClient.GetFromJsonAsync&lt;Servertime&gt; (&quot;http://localhost:4040&quot;);
          message = response.servertime;
          this.StateHasChanged();
      }
  </code></pre>
  <p>But it still results in the client CORS exception.
  To bypass this for development I use the browser extension “CORS Unblock”, but this is not an option for deployment.</p>
  <p>What would be the correct approach to avoid Blazor client exception,
  what do I miss?</p>