CORS in .NET

Updated on: September 1, 2025

Introduction

Your application can securely process cross-origin requests thanks to CORS in.NET. When the frontend and backend of an API project are hosted on separate domains, it is crucial.

Because of security concerns, browsers by default block such requests. However, this problem can be avoided by setting up CORS in .NET application. It also guarantees seamless and safe connectivity between various origins.

What is CORS (Cross-Origin Resource Sharing)?

A browser feature called CORS shields users from unwanted cross-origin calls. The browser determines whether the API permits access to https://api.domain.com if your frontend on https://frontend.com attempts to reach it.

The browser stops the request if the correct CORS policy is not specified. As a result, proper configuration is essential for every Web API built on.NET.

Why it is Important in .NET Projects?

Many modern web apps just cannot work without CORS. For instance, if a .NET API does not specifically permit it, a React application using it will receive a CORS issue.

Additionally, it is useful:

Avoid security flaws.
Make sure the API behaves correctly.
Facilitate seamless connection between the frontend and backend.

How to Enable it?

In a.NET Core or.NET 6+ application, to activate CORS:

1. Include the CORS service in Program.cs or Startup.cs:

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowAll",
        builder => builder
            .AllowAnyOrigin()
            .AllowAnyMethod()
            .AllowAnyHeader());
});

2. Use the CORS policy in the middleware pipeline:

app.UseCors("AllowAll");

Note: “AllowAll” only for development use. Define distinct origins for production to improve security.

CORS Configuration in ASP.NET Core Web API

You can customize your CORS policy to allow specific domains, methods, or headers.

options.AddPolicy("CustomPolicy", builder =>
{
    builder.WithOrigins("https://yourfrontend.com")
           .WithMethods("GET", "POST")
           .WithHeaders("Content-Type");
});

This helps control what external sources can access your API.

Common CORS Errors and How to Fix Them

Absence of the “Access-Control-Allow-Origin” header.
➤ Fix: Verify if the request’s origin is permitted by the CORS policy.
Preflight request fails with 405 .
➤ Fix: Make sure your Web API routing is enabled for the OPTIONS method.
In production, CORS is not functioning.
➤ Fix: Check server settings, like HTTPS and headers, and policy configuration.

CORS in .NET 6 Minimal APIs

Setting it up is simple and requires few APIs.

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCors();

var app = builder.Build();

app.UseCors(policy => policy
    .WithOrigins("https://frontend.com")
    .AllowAnyMethod()
    .AllowAnyHeader());

app.MapGet("/", () => "Hello World!").RequireCors(policy =>
    policy.WithOrigins("https://frontend.com"));

app.Run();