title: CORS Issue with Angular MSAL Azure AD Dotnet Core Web API
body: <p>I have been working through this tutorial:</p>
  
  <p><a href="https://github.com/Azure-Samples/ms-identity-javascript-angular-spa-aspnetcore-webapi" rel="nofollow noreferrer">https://github.com/Azure-Samples/ms-identity-javascript-angular-spa-aspnetcore-webapi</a></p>
  
  <p>The Authentication works fine.</p>
  
  <p>However, I get a CORS exception in the console:</p>
  
  <p>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at <a href="https://localhost:44351/api/todolist/" rel="nofollow noreferrer">https://localhost:44351/api/todolist/</a>. (Reason: CORS request did not succeed).</p>
  
  <p>In startup.cs I changed:</p>
  
  <p>// builder.AllowAnyOrigin()
  //        .AllowAnyMethod()
  //        .AllowAnyHeader();</p>
  
  <p>to:</p>
  
  <p>builder.WithOrigins("<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>")
           .AllowAnyMethod()
           .AllowAnyHeader()
           .AllowCredentials();</p>
  
  <p>This had no effect.</p>
  
  <p>Can anyone help me to resolve please?</p>
  
  <p>Here is the startup.cs</p>
  
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      public void ConfigureServices(IServiceCollection services)
      {
          services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
              .AddProtectedWebApi(Configuration);
  
          // Creating policies that wraps the authorization requirements
          services.AddAuthorization();
  
          services.AddDbContext&lt;TodoContext&gt;(opt =&gt; opt.UseInMemoryDatabase("TodoList"));
  
          services.AddControllers();
  
          services.AddCors(o =&gt; o.AddPolicy("default", builder =&gt;
          {
              builder.AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader();
          }));
      }
  
      public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
      {
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
          else
          {
              app.UseHsts();
          }
  
          app.UseCors("default");
          app.UseHttpsRedirection();
          app.UseRouting();
          app.UseAuthentication();
          app.UseAuthorization();
          app.UseEndpoints(endpoints =&gt;
          {
              endpoints.MapControllers();
          });
      }
  }
  </code></pre>