How can I get rid of CORs errors completely in my .Net Core Web API?

Question

I have a web api on a IIS server using .Net Core 3.1.

It is using the IP and Port of: http://68.181.207.10:8473

I also have 3 web applications that run on the same IIS server. 2 of the apps are .Net 4.7 apps and 1 is a .Net Core app.

The 3 web apps all use the web api.

The 3 apps are:

https://meta.astro.usc.edu (port 443)

http://old.astro.perl.edu (port 80)

http://68.181.207.10 (port 80)

I have set up the API to use CORs, and for the most part, everything is ok and they connect to the API without any issues.

But there are times when I will still run into CORs errors even though I have added all the needed URLs.

In the top of my ConfigureServices method, I am adding the needed URLs that will need access, like this:

public void ConfigureServices(IServiceCollection services) { services.AddCors(options => { options.AddPolicy(MyAllowSpecificOrigins, builder => { builder.WithOrigins("http://68.181.207.10:8473", "https://meta.astro.usc.edu", "http://old.astro.perl.edu", "http://68.181.207.10") .AllowAnyMethod() .AllowAnyHeader(); }); }); }

Then in my Configure method, I am adding app.UseCors as you can see below:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { if (env.IsDevelopment()) { app.UseDeveloperExceptionPage(); } else { app.UseHsts(); } app.UseRouting(); app.UseCors(MyAllowSpecificOrigins); app.UseHttpsRedirection(); app.UseMvc(); }

Is this the proper way of allowing these other web apps to connect to my web api?

The CORs errors seem random and the origins are always one of my 3 web apps. One doesn't seem to cause more errors than an another.

How can I prevent the intermittent CORs errors that I still receive?

Thanks!

You write The CORs errors seem random and the origins are always one of my 3 web apps. One doesn't seem to cause more errors than an another.. But you specify 4 sites in WithOrigins. I suspect there are http/https issues here. I also see that app.UseHttpsRedirection(); comes before app.UseCors in doc, maybe have a look into that too. — Roar S.
– Roar S., Commented Dec 10, 2020 at 15:42
@RoarS. I added http://68.181.207.10:8473, which is the URL for the web api itself. I added that out of desperation...it didn't really seem to help anything though. — SkyeBoniwell
– SkyeBoniwell, Commented Dec 10, 2020 at 15:49
OPTIONS request are preflight requests. Please look for requests that are not returning 2XX. — Roar S.
– Roar S., Commented Dec 10, 2020 at 18:04
Those requests came through and should be considered as app errors. Hence, there is chance that you don't have any CORS-errors at all. — Roar S.
– Roar S., Commented Dec 10, 2020 at 18:15
You also need to install IIS CORS module to be installed and configured, learn.microsoft.com/en-us/iis/extensions/cors-module/… to properly handle the edge cases when IIS handles CORS requests, not your ASP.NET Core web app. — Lex Li
– Lex Li, Commented Dec 10, 2020 at 20:42

rmk · Accepted Answer · 2020-12-10 15:19:36Z

1

Check for Internal Server Errors (500) in problematic requests

answered Dec 10, 2020 at 15:19

rmk

691 silver badge8 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Roar S. · Accepted Answer · 2020-12-10 18:32:16Z

1

After some discussion with OP, this issue might not relate to CORS at all after OP discovered 4XX-errors in the logs.

answered Dec 10, 2020 at 18:32

Roar S.

11.5k1 gold badge21 silver badges55 bronze badges

3 Comments

SkyeBoniwell Over a year ago

The thing I don't understand is that why would a 4XX error cause a CORs error to display in the browser console? THanks

Roar S. Over a year ago

If you are sure there are CORS-errors, you will still have to check the logs. May I ask what your source is for the CORS errors?

MemeDeveloper Over a year ago

I've def. had other errors "cause CORS in the browser"... literally just now left an appsettings.json with invalid json (typo) and result was CORS in browser for the UI requesting from the API that was misconfigured. Dunno why.. but..

Collectives™ on Stack Overflow

How can I get rid of CORs errors completely in my .Net Core Web API?

2 Answers 2

Comments

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Related