0

I can't seem to get any CORS header in my request to my Web API controller.

I am currently using ASP.net 5 - coreclr, and I have added the Microsoft.AspNet.Cors 6.0.0-rc1-final

public void ConfigureServices(IServiceCollection services)
{
        services.AddCors(options =>
        {
            options.AddPolicy("AllowAll", builder => builder.AllowAnyHeader().AllowAnyMethod().AllowAnyOrigin());
        });

        services.AddMvc();

        services.AddSingleton<ConnectionMultiplexer>(x => ConnectionMultiplexer.Connect("localhost"));
        services.AddScoped<IDatabase>(x => (x.GetService(typeof(ConnectionMultiplexer)) as ConnectionMultiplexer).GetDatabase());
        services.AddScoped<IFitnessStorage, FitnessStorage>();
        services.AddScoped<IFitnessTrackingService, FitnessTrackingService>();
}


public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
        loggerFactory.AddConsole(Configuration.GetSection("Logging"));
        loggerFactory.AddDebug();

        app.UseCors("AllowAll");
        app.UseIISPlatformHandler();
        app.UseStaticFiles();
        app.UseMvc();
}

I do not have any [EnableCors] on my controllers, because the UseCors should set it for every request - AFAIK..

  HTTP/1.1 200 OK
  Date: Wed, 20 Jan 2016 11:24:36 GMT
  Content-Type: application/json; charset=utf-8
  Server: Kestrel
  Transfer-Encoding: chunked

  GET /api/FitnessTrackGroup HTTP/1.1
  Host: localhost:5000
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Upgrade-Insecure-Requests: 1
  User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36
  DNT: 1
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: da,en-US;q=0.8,en;q=0.6,nb;q=0.4
TryingToImprove
  • 7,047
  • 4
  • 30
  • 39

1 Answers1

1

If your request doesn't include the Origin header, i.e. a same-origin request, the CORS middleware is effectively a noop. It's basically bailing out at the first step here...

CORS Flow

Chrome doesn't include the Origin header in same-origin GET requests... See Chrome adding Origin header to same-origin request.

Community
  • 1
  • 1
khellang
  • 17,550
  • 6
  • 64
  • 84