title: ASP.NET Core CORS request blocked; why doesn't my API apply the right headers?
body: <p>Trying to set up CORS with authentication. I have a Web API site up at <a href="http://localhost:61000" rel="noreferrer">http://localhost:61000</a> and a consuming web application up at <a href="http://localhost:62000" rel="noreferrer">http://localhost:62000</a>.  In the Web API Startup.cs, I have:</p>
  
  <pre><code> public void ConfigureServices(IServiceCollection services)
   {
          services.AddCors(o =&gt; o.AddPolicy("MyPolicy", corsBuilder =&gt;
          {
              corsBuilder.WithOrigins("http://localhost:62000")
                  .AllowAnyMethod()
                  .AllowAnyHeader()
                  .AllowCredentials();
          }));
          IMvcBuilder builder = services.AddMvc();
          // ...
  }
  
  // ...
  
  public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
          app.UseCors("MyPolicy");
          app.UseDeveloperExceptionPage();
          app.UseDefaultFiles();
          app.UseStaticFiles();
          app.UseMvc();
  }
  </code></pre>
  
  <p>All the doucmentation seems to indicate that should be all I need.  In my app's Javascript, I call:</p>
  
  <pre><code>    $.ajax({
          type: 'POST',
          url: "http://localhost:61000/config/api/v1/MyStuff",
          data: matchForm.serialize(),
          crossDomain: true,
          xhrFields: { withCredentials: true },
          success: function (data) {
              alert(data);
          }
      });
  </code></pre>
  
  <p>And I get in Chrome: <code>Failed to load http://localhost:61000/config/api/v1/MyStuff: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:62000' is therefore not allowed access.</code></p>
  
  <p>...and in Firefox: <code>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:61000/config/api/v1/MyStuff. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).</code> </p>
  
  <p>What am I missing?  This should be all I need to enable CORS, I thought, but clearly there is something else missing.</p>