title: Can't enable CORS in ASP.Net Core web api
body: <p>I created an ASP.Net CORE web API project, with a single controller, and would now like to call it from a client (React) web app.</p>
  
  <p>However, the call fails with "No 'Access-Control-Allow-Origin' header is present on the requested resource.".</p>
  
  <p>When calling the same endpoint from Fiddler, the expected response headers are not present.</p>
  
  <p>Thanks to ATerry, I have further insight: the headers are not present, because the React web app and the .Net Core web API are hosted on the same box. React populates the request Origin: header which is the same as the (API) box, thus the server (being really clever about it) does not add the Allow-... response headers. However, the React app rejects the response, because of the lack of those headers.</p>
  
  <p>I'm using .Net Core v2.1 (latest as of this writing).</p>
  
  <p>I built the code based on </p>
  
  <p><a href="https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1</a></p>
  
  <p>I checked these</p>
  
  <p><a href="https://weblog.west-wind.com/posts/2016/Sep/26/ASPNET-Core-and-CORS-Gotchas" rel="nofollow noreferrer">https://weblog.west-wind.com/posts/2016/Sep/26/ASPNET-Core-and-CORS-Gotchas</a></p>
  
  <p><a href="https://stackoverflow.com/questions/40043097/cors-in-net-core">CORS in .NET Core</a></p>
  
  <p><a href="https://stackoverflow.com/questions/31942037/how-to-enable-cors-in-asp-net-core">How to enable CORS in ASP.NET Core</a></p>
  
  <p>... but none of the suggestions worked.</p>
  
  <p>Any ideas?</p>
  
  <p>This is how I configure the .Net Core app (code changed from actual to try and allow anything):</p>
  
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      // This method gets called by the runtime. Use this method to add services to the container.
      public void ConfigureServices(IServiceCollection services)
      {
          // Enable CORS (Cross Origin Requests) so that the React app on a different URL can access it
          // See https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-2.1
          services.AddCors(options =&gt;
          {
              options.AddPolicy(Global.CORS_ALLOW_ALL_POLICY_NAME, builder =&gt; builder
                  .AllowAnyOrigin()
                  .AllowAnyHeader()
                  .AllowAnyMethod()
                  .AllowCredentials());
          });
  
          services.AddMvc();
      }
  
      // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
          else
          {
              app.UseHsts();
          }
  
          app.UseCors(Global.CORS_ALLOW_ALL_POLICY_NAME);
  
          app.UseHttpsRedirection();
          app.UseMvc();
      }
  }
  </code></pre>
  
  <p>Having failed with just the above, I added the CORS attributes to the controller class and controller methods too:</p>
  
  <pre><code>[Route("api/[controller]")]
  [ApiController]
  [EnableCors(Global.CORS_ALLOW_ALL_POLICY_NAME)]
  public class DealsController : ControllerBase
  {
  [...]
  [HttpGet]
      [EnableCors(Global.CORS_ALLOW_ALL_POLICY_NAME)]
      public ActionResult&lt;List&lt;Deal&gt;&gt; GetAll()
      {
          return Store;
      }
  }
  </code></pre>
  
  <p>The response headers I get:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Transfer-Encoding: chunked
  Content-Type: application/json; charset=utf-8
  Server: Kestrel
  X-Powered-By: ASP.NET
  Date: Thu, 06 Sep 2018 12:23:27 GMT
  </code></pre>
  
  <p>The missing headers are:</p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Origin: http://localhost:3000
  </code></pre>