How to disable CORS in WPF WebView2

Question

I'm developing an app that displays WebView2 using .Net5/WPF.
I want to disable CORS.
I have installed Chromium Edge Canary 86.0.607.0.
In Edge, CORS could be disabled by adding the following argument to the shortcut.

--disable-web-security --user-data-dir="C://Chrome dev session"

I want to disable WebView2 as well.

score 5 · Answer 1 · answered May 26 '21 at 11:32

5

For WPF, Call following code in constructor

 async void InitializeAsync()
        {
            var op = new CoreWebView2EnvironmentOptions("--disable-web-security");
            var env = await CoreWebView2Environment.CreateAsync(null, null, op);
            await webView.EnsureCoreWebView2Async(env);
        }

answered May 26 '21 at 11:32

Prasanth V J

1,126
14
32

1

using `--allow-file-access-from-files` will work as well if you don't want to disable all of CORS but need local file access. – mbassett Jan 14 '22 at 22:17
How about WebView? It seems WebView doesn't have the environment settings. – jerry Jul 13 '22 at 06:22
This also works for Winforms, not only WPF. – Matt Jul 19 '22 at 09:38

score 2 · Accepted Answer · answered Aug 15 '20 at 02:53

I got an answer in this forum. Sorry, this site is in Japanese.
https://social.msdn.microsoft.com/Forums/ja-JP/9bac6d51-94eb-42c8-96f0-4081e9a4056d/wpf-webview2-cors-?forum=wpfja

It worked with the code below.
*It is necessary to set before specifying the URL in WebView2.Source.
Be careful not to specify Source on Xaml side.

    /// <summary>
    /// WPF Window Constructor
    /// </summary>
    /// <param name="url">URL</param>
    public WebViewWindow(string url)
    {
        InitializeComponent();
        // async start
        Loaded += async (_, __) => await _Routine(url);
    }

    /// <summary>
    /// task
    /// </summary>
    /// <param name="url">URL</param>
    /// <returns>task</returns>
    async Task _Routine(string url)
    {
        var localPath = Environment.GetEnvironmentVariable("LocalAppData");
        var webviewPath = $@"{localPath}\Microsoft\Edge SxS\Application\86.0.608.0";
        var userPath = "C://Chrome dev session";
        
        // Argument setting to disable COAR
        var op = new CoreWebView2EnvironmentOptions("--disable-web-security");
        
        var env = await CoreWebView2Environment.CreateAsync(webviewPath, userPath, op);
        
        await webView.EnsureCoreWebView2Async(env);
        
        if (Uri.TryCreate(url, UriKind.RelativeOrAbsolute, out Uri? result))
        {
            webView.Source = result;
        }
    }

Seems like you have to change the path every time Edge is updated — Poul Bak, Aug 15 '20 at 04:51

score 2 · Answer 3 · answered Nov 01 '21 at 09:38

Another option is to create a virtual host. For a detailed information see CoreWebView2.SetVirtualHostNameToFolderMapping:

Sets a mapping between a virtual host name and a folder path to make available to web sites via that host name.

Example:

public class VirtualHost
{
    private WebView2 webView;
    private string hostName;
    private string directory;

    public VirtualHost(WebView2 webView, string hostName, string directory)
    {
        this.webView = webView;
        this.hostName = hostName;
        this.directory = directory;
        _ = InitializeAsync();
    }

    async private Task InitializeAsync()
    {
        // Wait for CoreWebView2 initialization.
        // Explicitly triggers initialization of the control's CoreWebView2.
        await webView.EnsureCoreWebView2Async();

        // Set a mapping between a virtual host name and a folder path
        // to make available to web sites via that host name.
        webView.CoreWebView2.SetVirtualHostNameToFolderMapping(
            hostName, directory, CoreWebView2HostResourceAccessKind.DenyCors);

        webView.Source = new Uri($"https://{hostName}/index.html");
    }
}

var localPath = Environment.GetEnvironmentVariable("LocalAppData");
virtualHost = new VirtualHost(view.configuratorWebView, "mylocalhost", localPath);

How to disable CORS in WPF WebView2

3 Answers3

Linked