Hands-On RESTful Web Services with ASP.NET Core 3

Enabling CORS in ASP.NET Core

Another critical aspect of security is to protect our APIs from CORS calls. By default, it is not possible to use client-side code to call services that are hosted on other domains, because scam websites may use a cross-origin call to get sensitive information about users. This security restriction is called the same-origin policy.

The restrictions on the same-origin policy act on HTTP calls using the following criteria:

• The request is made from a different domain (for example, the site at example.com calls api.com).
• The request is enabled from a different subdomain (for example, the website at example.com calls api.example.com).
• The request is made from a different port (for example, the site at example.com ...