Benutzer:MovGP0/ASP.NET Core/CORS

MovGP0

Über mich

Hilfen

Artikel

Weblinks

Literatur

Zitate

Notizen

Programmierung

MSCert

Physik

Programmierung ASP.NET Common OWIN • Razor • WebForms • MVC • WebAPI Core Configuration • Data Protection API • Dependency Injection • Routing Attack Vectors HTTPS • HSTS • HPKP • CSP • CSRF • Anti-XSS • CORS • Open Redirection • Click-Jacking Libraries OpenID • Azure AD

Cross-Origin Resource Sharing

• Allows AJAX calls to other domains that the domain where the JavaScript script was loaded from

Startup.cs

public void ConfigureServices(IServiceCollection services)
{
    services.AddCors(options =>
    {
        options.AddPolicy("CorsPolicy", builder => builder
            .WithOrigins("http://example.com")
            .AllowAnyMethod()
            .AllowAnyHeader()
            .AllowCredentials());
    });
}


public void Configure(IApplicationBuilder app)
{
    app.UseCors(c => c.WithOrigins("http://example.com")); // default policy
    app.UseCors("CorsPolicy"); // named policy

    // ensure UseCors() is called before this
    app.UseMvc(routes =>
    {
        routes.MapRoute(
            name: "default",
            template: "{controller=Home}/{action=Index}/{id?}");
    });
}

• use [EnableCors("CorsPolicy")] to enable policies on specific controllers.

Quellen

• Mike Wasson, Shayne Boyer: Enabling Cross-Origin Requests (CORS). In: ASP.NET Core Docs. Microsoft, 14. Oktober 2016, abgerufen am 15. Mai 2017. 

|}