title: API is still accessible through POSTMAN even after enabling CORS with ASP.NET CORE Web Api
body: <p>I created the following...</p>
  <ol>
  <li>One backend .NET Core POST API running on IIS</li>
  <li>Two UI apps created with Angular CLI and running with the port 8888 and 9999 respectively</li>
  <li>I have enabled CORS in .NET Core application</li>
  </ol>
  <p>While integrating CORS in .NET Core, I have added the following in startup.cs</p>
  <p><strong>Startup.cs</strong></p>
  <pre class="lang-c# prettyprint-override"><code>public class Startup
      {
          readonly string _allowSpecificOrigins = &quot;_allowOrigin&quot;;
  
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddControllers();
              services.AddCors(policy =&gt;
              {
                  policy.AddPolicy(name: _allowSpecificOrigins, options =&gt; options.WithOrigins(&quot;http://localhost:9999&quot;).AllowAnyHeader().AllowAnyMethod());
              });            
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              
              app.UseRouting();
              app.UseCors(options =&gt; options.WithOrigins(&quot;http://localhost:9999&quot;).AllowAnyHeader().AllowAnyMethod());
              app.UseAuthorization();
              
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllers().RequireCors(_allowSpecificOrigins);
              });
          }
      }
  </code></pre>
  <p>And CORS is perfectly working as expected. For testing, I have created two angular applications which are running with the two different port 8888 and 9999. PORT 9999 is configured and allowed in the startup.cs to be accessible the API. So, from the PORT 9999, application can access the API while the application with the PORT 8888, could not access the API due to CORS error as you can see the responses.</p>
  <p><a href="https://i.stack.imgur.com/qOgze.png" rel="nofollow noreferrer">API response when calling from the url http://localhost:8888</a></p>
  <p><a href="https://i.stack.imgur.com/eEMgc.png" rel="nofollow noreferrer">API response when calling from the url http://localhost:9999</a></p>
  <p>Now problem is that, I can still access the same API from POSTMAN after overwriting all the headers</p>
  <ul>
  <li>Accept</li>
  <li>Accept-Encoding</li>
  <li>Connection</li>
  <li>Referer</li>
  <li>or even User-Agent</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/agQFh.png" rel="nofollow noreferrer">Please look at the response received from POSTMAN</a></p>
  <p>Any help is greatly appreciated. Thank you.</p>