.net 5 CORS action call is locked even with EnableCors attribute

user_2711395 0
Viewed 93

I have a controller where i enabled cors

[EnableCors(Startup.CORS_POLICY_EXTERNAL)]
public class MasterController : Controller
{
    [HttpGet]
    public IActionResult TestaConnessione()
    {
        return Ok();
    }
}

but with a simple fetch:

fetch("url/MasterController/TestaConnessione")

caller get header CORS “Access-Control-Allow-Origin” missing

but if the caller use iframe all works fine:

<iframe name="ifrReport" id="ifrReport"></iframe>

<script type="text/javascript">
    (function () {
        let form, input;
        form = document.createElement("form");
        form.action = "URL";
        form.target = "ifrReport";
        form.method = "POST";       
        document.body.appendChild(form);
        form.submit();
    })();

</script>

that's the startup config:

public const string CORS_POLICY_EXTERNAL = "CORS_POLICY_EXTERNAL";
        public const string CORS_POLICY_LOCAL = "CORS_POLICY_LOCAL";
    services.AddCors(options =>
                {
                    options.AddPolicy(name: CORS_POLICY_EXTERNAL,
                                      builder =>
                                      {
                                          builder.AllowAnyOrigin()
                                          .AllowAnyMethod()
                                          .AllowAnyHeader();
    
                                      });
                    options.AddPolicy(name: CORS_POLICY_LOCAL,
                                      builder =>
                                      {
                                          builder.WithOrigins("http://localhost")
                                          .AllowAnyMethod()
                                          .AllowAnyHeader();
    
                                      });
                });
    
    app.UseRouting();
    
                app.UseCors();
    
                app.UseAuthentication();
                app.UseMiddleware<AuthenticationMiddleware>();
                var options = app.ApplicationServices.GetService<IOptions<RequestLocalizationOptions>>();
                app.UseRequestLocalization(options.Value);
                app.UseAuthorization();
cors asp.net-mvc .net
2 Answers

As already answered multiple times, you can't bypass CORS just from client (your) side only. That feature needs to be enabled on the target server too. To quote from this answer:

The header of the response, even if it's 200OK do not allow other origins (domains, port) to access the resources. You can fix this problem if you are the owner of the domain

Also, when you gave the example of js script that appends form to document and submits it, that is not related to CORS, because in that case, no AJAX/XHR request is made, instead it is form submit action, which can be done with any domain, regardless their CORS policy (though there exist other measures too, which might even block form-submission from other domains, but that is not scope of this question)

As as solution, you might try to trigger the request from client-side to backend of the app, which will make a request to target domain, and then your backend app provides that result back to client-side. That way, you will no need to worry about CORS policies.

user_23773430
user_27113950
Related