title: How to add the "Access-Control-Allow-Credentials" request header to a POST request in ASP.NET?
body: <p>So, I am trying to set the &quot;Access-Control-Allow-Credentials&quot;, using the <code>HttpContext.Request.Headers.Add(&quot;Access-Control-Allow-Credentials&quot;, &quot;true&quot;); </code>, but it will only work for my GET requests, but not for my POST ones, and i don't know why.</p>
  <p>I've also tried to set those in Startup.cs, as so:</p>
  <pre><code> services.AddCors(o =&gt; o.AddPolicy(&quot;ApiCorsPolicy&quot;, builder =&gt;
              {
                  builder
                         .WithOrigins(&quot;My_Web_App&quot;)
                         .AllowCredentials()
                         .AllowAnyMethod()
                         .AllowAnyHeader();
              }));
  </code></pre>
  <p>And then use it in Configure with <code>app.UseCors(&quot;ApiCorsPolicy&quot;);</code></p>
  <p>That's the code from my controller, so nothing fancy in here, I think:</p>
  <pre><code>   [ApiController]
      [Route(&quot;[controller]&quot;)]
      [EnableCors(&quot;ApiCorsPolicy&quot;)]
      public class UserController : Controller
      {
          private readonly IUserService _userService;
          public UserController(IUserService userService)
          {
              _userService = userService;
          }
  
          [HttpPost(&quot;RegisterUser&quot;)]
          public void GetTournaments([FromBody] UserDTO user)
          {
  
              HttpContext.Request.Headers.Add(&quot;Access-Control-Allow-Credentials&quot;, &quot;true&quot;);
              _userService.RegisterUser(user);
          }
  
      }
  </code></pre>
  <p>My question is, why I can't put the &quot;Access-Control-Allow-Credentials&quot; header using the <code>Headers.add</code> method( Which works for my GET requests ) ? If that is not the correct approach to it, then how to do it ?
  Thanks!</p>
  <p>Edit:
  I've added all my Startup file, as requested:</p>
  <pre><code>    public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
        
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddCors(o =&gt; o.AddPolicy(&quot;ApiCorsPolicy&quot;, builder =&gt;
              {
                  builder
                         .WithOrigins(&quot;http://&quot;MyIpAddressHere&quot;/&quot;)
                         .AllowAnyMethod()
                         .AllowAnyHeader();
              }));
  
              var mapperConfig = new MapperConfiguration(mc =&gt;
              {
                  mc.AddProfile(new MappingGeneral());
              });
  
              IMapper mapper = mapperConfig.CreateMapper();
              services.AddSingleton(mapper);
  
              services.AddSingleton&lt;ITournamentService, TournamentService&gt;();
              services.AddSingleton&lt;IUserService, UserService&gt;();
              services.AddControllers();
              services.AddSwaggerGen(c =&gt;
              {
                  c.SwaggerDoc(&quot;v1&quot;, new OpenApiInfo { Title = &quot;my_app&quot;, Version = &quot;v1&quot; });
              });
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
  
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
                  app.UseSwagger();
                  app.UseSwaggerUI(c =&gt; c.SwaggerEndpoint(&quot;/swagger/v1/swagger.json&quot;, &quot;my_app v1&quot;));
              }
  
              app.UseRouting();
  
              app.UseCors(&quot;ApiCorsPolicy&quot;);
  
              app.UseAuthorization();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllers();
              });
  
  
          }
      }
  
  </code></pre>