Enable CORS from a specific origin on Topshelf hosted service

Question

I'm sure this is a duplicate but none of the answers I've found appears to be working.

I have a web.api hosted as a windows service and I need to allow CORS to two specific origins.

I have this in my startup.cs

config.EnableCors(
            new EnableCorsAttribute("http://customer.mydomain.com, 
                                     http://admin.mydomain.com", "*", "*")
            );
        var policy = new CorsPolicy()
        {
            AllowAnyHeader = true,
            AllowAnyMethod = true,
            SupportsCredentials = true
        };

        policy.Origins.Add("*http://customer.mydomain.com");
        policy.Origins.Add("*http://admin.mydomain.com");

        app.UseCors(new CorsOptions
        {
            PolicyProvider = new CorsPolicyProvider
            {
                PolicyResolver = context => Task.FromResult(policy)
            }
        });

So my understanding here is that I'll only allow access to my service from admin and customer subdomains?

and then on top of my controller I have

[EnableCors("*.mydomain.com","*","*")]  
public class MasterDataController

everything builds and is happy but when I run my service and call a method in the controller directly from the browser URL it responds fine, shouldn't it be blocking me as I'm not calling it from mydomain.com ?

I've seen answers saying I need to send my origin in my call but surely that's not the answer as I specifically want to stop calls unless they are from my allowed origins? I feel like I'm going in circles here

[Update] I've also added

   <httpProtocol>
 <customHeaders>
   <add name="Access-Control-Allow-Origin" value="*.bizcash.co.za" />
 </customHeaders>

to my IIS proxy and if I check the response headers when I call the method directly I see the following

*.redacted obviously being my domain. However, I can still call it directly from my browser and it shouldn't allow that should it? It should only allow the calls if made from my domain?

score 0 · Answer 1 · answered Feb 25 '19 at 19:36

okay, so two problems with the question.

adding specific CORS origins doesn't stop you calling the service directly in the browser, it stops other web applications calling it. So I was testing it wrong.

So you need to make your changes, deploy it to your server and then test it via your normal applications.

to make it work this is what I have in the end

           var policy = new CorsPolicy()
        {
            AllowAnyHeader = true,
            AllowAnyMethod = true
        };

        policy.Origins.Add("https://customer.mydomain.com");
        policy.Origins.Add("https://admin.mydomain.com");

        app.UseCors(new CorsOptions
        {
            PolicyProvider = new CorsPolicyProvider
            {
                PolicyResolver = context => Task.FromResult(policy)
            }
        });

That's it, just that in the startup.cs and it works. Hopefully I save someone else two wasted days of life

Enable CORS from a specific origin on Topshelf hosted service

1 Answers1