ASP.NET Web API Security Essentials

Enabling CORS at various scope

CORS can be enabled at various levels. We can set CORS at action level, controller level, or global level. Let's see how to set CORS at various scope.

Enable at action level

To enable CORS to a specific action, we need to decorate the action method with the [EnableCors] attribute as given in the following code snippet:

public class ContactsController : ApiController
{
    [EnableCors(origins: "http://localhost:53870", headers: "*", methods: "*")]
    public HttpResponseMessage GetContacts() { ... }
    
    public HttpResponseMessage GetContact(int id) { ... }
    public HttpResponseMessage PostContact() { ... }
    public HttpResponseMessage PutContact(int id) { ... }
}

As you can see, CORS is only applicable for the GetContacts() action method. ...